chore: check off Task 3 (PermissionGuard + decorators)

docs/superpowers/plans/2026-07-02-rbac-refactor.md

@@ -557,7 +557,7 @@ git commit -m "feat(rbac): add RbacModule and RbacService with seed data and rol
 - Consumes: `ExecutionContex`, `Reflector` (NestJS Core)
 - Produces: `@Public()` (SetMetadata IS_PUBLIC_KEY true), `@RequirePermission(...codes: string[])` (SetMetadata PERMISSION_KEY), `PermissionGuard implements CanActivate`
 
-- [ ] **Step 1: 创建 @Public 装饰器**
+- [x] **Step 1: 创建 @Public 装饰器**
 
 ```typescript
 // backend/src/auth/decorators/public.decorator.ts
@@ -567,7 +567,7 @@ export const IS_PUBLIC_KEY = 'isPublic';
 export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
 ```
 
-- [ ] **Step 2: 创建 @RequirePermission 装饰器**
+- [x] **Step 2: 创建 @RequirePermission 装饰器**
 
 ```typescript
 // backend/src/auth/decorators/permission.decorator.ts
@@ -584,7 +584,7 @@ export const RequirePermission = (...permissions: string[]) =>
   SetMetadata(PERMISSION_KEY, permissions);
 ```
 
-- [ ] **Step 3: 创建 PermissionGuard**
+- [x] **Step 3: 创建 PermissionGuard**
 
 ```typescript
 // backend/src/auth/guards/permission.guard.ts
@@ -690,7 +690,7 @@ NestJS 中，**同一个 key** 多次 `SetMetadata` 时，后面的会覆盖前
 
 实际代码实现如下。现在继续写 plan。
 
-- [ ] **Step 3 (修正版): 创建 PermissionGuard**
+- [x] **Step 3 (修正版): 创建 PermissionGuard**
 
 ```typescript
 // backend/src/auth/guards/permission.guard.ts
@@ -730,7 +730,7 @@ export class PermissionGuard implements CanActivate {
 }
 ```
 
-- [ ] **Step 4: 编译验证**
+- [x] **Step 4: 编译验证**
 
 ```bash
 cd backend && npx tsc --noEmit
@@ -738,7 +738,7 @@ cd backend && npx tsc --noEmit
 
 预期：无类型错误。
 
-- [ ] **Step 5: Commit**
+- [x] **Step 5: Commit**
 
 ```bash
 git add backend/src/auth/decorators/ backend/src/auth/guards/permission.guard.ts