fix(app): 清理旧版系统权限组

- 将旧版默认权限组 ID 纳入清理列表，确保初始化时自动删除遗留数据。
- 补充测试验证旧版权限组会在默认权限组修复流程中被移除。

apps/api/internal/app/app_test.go

@@ -1174,6 +1174,37 @@ func TestFixedRolesProtectAdminRoutesAndDefaultAdmin(t *testing.T) {
 	}
 }
 
+func TestLegacySystemPermissionGroupsAreCleanedUp(t *testing.T) {
+	a := newTestApp(t)
+	ctx := context.Background()
+	now := time.Now().UTC().Format(time.RFC3339Nano)
+	legacyIDs := []string{
+		"pg_permission_manager",
+		"pg_user_manager",
+		"pg_system_operator",
+		"pg_mail_operator",
+	}
+
+	for _, groupID := range legacyIDs {
+		if _, err := a.db.ExecContext(ctx, `INSERT INTO permission_groups(id,name,description,permissions_json,system,created_at,updated_at)
+			VALUES(?,?,?,?,1,?,?)`, groupID, "Legacy "+groupID, "", "[]", now, now); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := a.ensureDefaultPermissionGroups(ctx); err != nil {
+		t.Fatal(err)
+	}
+	for _, groupID := range legacyIDs {
+		var count int
+		if err := a.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM permission_groups WHERE id=?`, groupID).Scan(&count); err != nil {
+			t.Fatal(err)
+		}
+		if count != 0 {
+			t.Fatalf("legacy permission group %s was not removed", groupID)
+		}
+	}
+}
+
 func TestMaildirSyncImportsRFC822(t *testing.T) {
 	a := newTestApp(t)
 	ctx := context.Background()

apps/api/internal/app/permissions.go

@@ -79,6 +79,10 @@ const (
 )
 
 var legacyDefaultPermissionGroupIDs = []string{
+	"pg_permission_manager",
+	"pg_user_manager",
+	"pg_system_operator",
+	"pg_mail_operator",
 	PermissionGroupUserAdmin,
 	PermissionGroupPermissionAdmin,
 	PermissionGroupDomainAdmin,