feat(client): 初始化前端壳与鉴权守卫（P1-5）

- 技术栈：React 18 + TypeScript + Vite + Tailwind

- API 层：ApiError + 401 自动刷新 + single-flight 重试

- 鉴权：内存 Access Token + Cookie Refresh + 启动 bootstrap

- RBAC：权限映射 + RequireAuth/RequirePermission 路由守卫

- 布局：OA 工作台壳层 + 侧边栏 + 5 个占位页面

- 样式：复用 hyb-web 视觉 token（单向同步）

- 文档：新增 client README，补充 server 联调说明

client/src/components/navigation/Topbar.tsx

@@ -0,0 +1,38 @@
+import { Link } from "react-router-dom";
+import { useAuth } from "../../auth/AuthContext";
+
+export function Topbar() {
+  const { me, logout } = useAuth();
+  const roleCodes = me?.roleCodes ?? [];
+
+  return (
+    <header className="sticky top-0 z-20 border-b border-slate-200 bg-white/95 px-4 py-3 backdrop-blur sm:px-6">
+      <div className="flex items-center justify-between gap-4">
+        <div>
+          <p className="text-sm text-secondary">欢迎回来</p>
+          <p className="text-base font-semibold text-slate-900">{me?.name ?? "-"}</p>
+        </div>
+
+        <div className="flex items-center gap-3">
+          <div className="hidden text-right sm:block">
+            <p className="text-xs uppercase tracking-wide text-secondary">角色</p>
+            <p className="text-sm font-medium text-slate-900">{roleCodes.join(" / ") || "-"}</p>
+          </div>
+
+          <Link className="btn-secondary text-sm" to="/settings/profile">
+            个人设置
+          </Link>
+          <button
+            className="btn-primary text-sm"
+            onClick={() => {
+              void logout();
+            }}
+            type="button"
+          >
+            退出登录
+          </button>
+        </div>
+      </div>
+    </header>
+  );
+}