feat(scripts): 跨 owner 懒加载目录树 + 跨用户可见 workspace/public

修两个后端接口问题:
1) /api/v1/workspace-directories 返回为空,目录树结构消失
2) 同 workspace 内脚本/数据互相可见但默认排除 private

后端改动
--------
* list_scripts / list_resources / list_workspace_directories 新增
  owner_user_id 可选 query 参数;缺省 = 当前请求者本人(scope 到
  workspace/{me}/...),传值时 scope 到该 owner 的子树。前端根加载
  默认只见自己一级,其他成员以折叠分组呈现。
* visibility 过滤统一:非 admin 请求者只返回 owner==me 或
  visibility ∈ {workspace, public};admin 跳过。owner=me 含自己
  的 private,owner=other 只剩其 workspace/public,排除他人 private。
* create_workspace_directory 两个分支 visibility 默认 'public'
  (非 private),使跨 owner 目录树可见;响应新增 owner_user_id 字段。
* platform.list_members 鉴权从 system_admin_context 放宽为
  系统管理员或该 workspace 活跃成员(让普通用户也能渲染同
  workspace 成员名册,用于跨 owner 分组)。
* main.py 注册 platform 模块(随 list_members 改动补齐导入)。
* .env.example 同步 common/config.py 26 个字段。

前端改动
--------
* ScriptExplorer.memberScriptGroups 改由 members 列表播种分组,
  display_name 取 members.display_name;inferredDirectories 现在按
  owner_user_id 标记,统一跨 owner 目录渲染。删除脚本目录页头与
  树分组标题的工作副本数量角标。
* WorkspaceTree 新增 ownerUserId 透传到 store.toggleExpanded;
  仅"我"的分组 mount 时 auto-expand,他人分组默认折叠,展开才
  调 loadOwnerGroup / owner-scoped loadScripts / loadChildren。
* scriptWorkspaceStore 引入 namespaced cache key
  (ownerCacheKey = `${ownerUserId ?? me}:${path}`),loadedScriptPaths
  / loadedChildPaths / loadedOwnerGroups 全部按 owner 隔离;
  toggleExpanded 用 loadPath === undefined 区分 group 头与真实
  目录,修"他人子目录点击不触发接口"的 loadPath 前缀误判 bug。
* api.ts / AuthContext 透传 ownerUserId 给 listScripts /
  listResources / listWorkspaceDirectories。

文档
----
* API.md: §3.2 创建目录 visibility 默认 public + 响应加 owner_user_id;
  §3.3.1 GET directories 加 owner_user_id 参数 + 响应字段;
  §3.4 GET scripts 改写为 owner 作用域 + visibility 过滤语义;
  §五.1 GET data-resources 新增,同一套统一语义;
  §7 intro 例外 — GET members 对系统管理员或 workspace 活跃成员开放。
* DEVELOP.md: Code layout 重写以反映 backend api/services/clients/
  schemas 拆分 + schedule domain/scheduling/application/execution/
  infrastructure 拆分 + common 子包(auth/storage/backends);
  Configuration 系统补全 26 个 settings 字段;新增
  "Owner-scoping + visibility (cross-owner browsing)" 小节;
  Per-service dev 注释用 uv run 的源布局要求;Add a new DAG endpoint /
  storage bucket 路径改为 backend/src/backend/api/* 与 services/*。

测试
----
* test_list_scripts_parent_path.py /
  test_resources.py 补充 owner_user_id 参数化直接调用 + LIKE
  前缀断言(workspace/{owner}/... 前缀)。

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/app/services/api.ts

@@ -191,6 +191,7 @@ export type WorkspaceDirectory = {
   path: string;
   name: string;
   parent_path: string;
+  owner_user_id: string;
   has_children?: boolean;
 };
 
@@ -287,13 +288,21 @@ async function apiRequest<T>(
 export async function listScripts(
   workspaceId: string,
   parentPath: string = "",
+  ownerUserId?: string,
 ): Promise<ScriptItem[]> {
-  // Empty parentPath omits the query string entirely so the backend's
-  // root-level filter is applied symmetrically with non-empty paths.
-  const query = parentPath
-    ? `?parent_path=${encodeURIComponent(parentPath)}`
-    : "";
-  return apiRequest<ScriptItem[]>(`/api/v1/scripts${query}`, {}, workspaceId);
+  // Default (no ownerUserId) scopes to the requester's own subtree; passing
+  // ownerUserId scopes to that owner's subtree (workspace/public only — the
+  // backend excludes their private) so the tree can lazily fetch another
+  // member's content when their group is expanded.
+  const parameters = new URLSearchParams();
+  if (parentPath) parameters.set("parent_path", parentPath);
+  if (ownerUserId) parameters.set("owner_user_id", ownerUserId);
+  const query = parameters.toString();
+  return apiRequest<ScriptItem[]>(
+    `/api/v1/scripts${query ? `?${query}` : ""}`,
+    {},
+    workspaceId,
+  );
 }
 
 export async function countScripts(
@@ -439,15 +448,16 @@ export type ResourceItem = {
 export async function listResources(
   workspaceId: string,
   parentPath: string = "",
-  opts?: { visibility?: string; keyword?: string },
+  opts?: { visibility?: string; keyword?: string; ownerUserId?: string },
 ): Promise<ResourceItem[]> {
-  // Empty parentPath omits the query string entirely so the backend's
-  // workspace-wide (root-level) filter is applied symmetrically with
-  // non-empty paths, matching listScripts.
+  // Default (no ownerUserId) scopes to the requester's own object_key
+  // subtree; passing ownerUserId scopes to that owner's subtree so the tree
+  // can lazily fetch another member's data resources on group expand.
   const parameters = new URLSearchParams();
   if (parentPath) parameters.set("parent_path", parentPath);
   if (opts?.visibility) parameters.set("visibility", opts.visibility);
   if (opts?.keyword) parameters.set("keyword", opts.keyword);
+  if (opts?.ownerUserId) parameters.set("owner_user_id", opts.ownerUserId);
   const query = parameters.toString();
   // apiRequest<T> already unwraps the envelope's `data` field, so we
   // request `ResourceItem[]` directly here (matching listScripts).
@@ -613,12 +623,18 @@ export async function deleteScript(
 export async function listWorkspaceDirectories(
   workspaceId: string,
   parentPath: string = "",
+  ownerUserId?: string,
 ): Promise<WorkspaceDirectory[]> {
-  const query = parentPath
-    ? `?parent_path=${encodeURIComponent(parentPath)}`
-    : "";
+  // Default (no ownerUserId) scopes to the requester's own subtree; passing
+  // ownerUserId scopes to that owner so the tree can lazily render their
+  // directory structure on expand. Directories are structural rows; file
+  // visibility is still enforced by the scripts/data-resources endpoints.
+  const parameters = new URLSearchParams();
+  if (parentPath) parameters.set("parent_path", parentPath);
+  if (ownerUserId) parameters.set("owner_user_id", ownerUserId);
+  const query = parameters.toString();
   const data = await apiRequest<{ directories: WorkspaceDirectory[] }>(
-    `/api/v1/workspace-directories${query}`,
+    `/api/v1/workspace-directories${query ? `?${query}` : ""}`,
     {},
     workspaceId,
   );
@@ -1487,6 +1503,7 @@ export async function getScheduleNodeRunArtifacts(
 export type WorkspaceBoundApi = {
   listScripts: (
     parentPath?: Parameters<typeof listScripts>[1],
+    ownerUserId?: Parameters<typeof listScripts>[2],
   ) => Promise<ScriptItem[]>;
   countScripts: () => Promise<number>;
   listResources: (
@@ -1527,7 +1544,10 @@ export type WorkspaceBoundApi = {
     scriptId: string,
     isLocked: boolean,
  ) => Promise<ScriptItem>;
-  listWorkspaceDirectories: (parentPath?: string) => Promise<WorkspaceDirectory[]>;
+  listWorkspaceDirectories: (
+    parentPath?: Parameters<typeof listWorkspaceDirectories>[1],
+    ownerUserId?: Parameters<typeof listWorkspaceDirectories>[2],
+  ) => Promise<WorkspaceDirectory[]>;
  createWorkspaceDirectory: (
     directoryName: string,
     parentPath?: string,