feat: Z38 grant Yuheng agents ready-to-use access

Complete permissions during every bind and token path, expose effective access in the console, and keep the platform return path globally available.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/logic/applogic/yuheng_restore.go

@@ -124,10 +124,7 @@ func (l *AuthLogic) RestoreByYuhengHost(req YuhengRestoreByHostReq) (*YuhengRest
 		return nil, restoreNeedBind("host_key 尚未完成同步绑定；请先绑定码/手机号绑定")
 	}
 
-	if err := l.ensureAgentSyncPerm(acc); err != nil {
-		return nil, err
-	}
-	acc, err = l.svcCtx.Agents.Get(l.ctx, acc.TenantID, acc.AgentID)
+	acc, err = l.ensureYuhengAgentPerms(acc)
 	if err != nil {
 		return nil, err
 	}
@@ -182,7 +179,7 @@ func (l *AuthLogic) RestoreByYuhengHost(req YuhengRestoreByHostReq) (*YuhengRest
 		AgentID:      acc.AgentID,
 		HostKey:      hostKey,
 		PhoneMasked:  phoneMasked,
-		Message:      "已按宇恒账号恢复同步绑定",
+		Message:      "已按宇恒账号恢复绑定并授权完成",
 	}, nil
 }