feat(api): 添加 graphrag 权限规则和优化知识图谱缓存失效

- 在权限规则匹配器中添加 /api/graphrag/** 的读写权限控制
- 修改图关系服务中的删除操作以精确失效相关实体缓存
- 更新图同步服务确保 BELONGS_TO 关系在增量同步时正确重建
- 重构图同步步骤服务中的组织归属关系构建逻辑
- 修复前端图_canvas 组件中的元素点击事件处理逻辑
- 实现 Python GraphRAG 缓存的启用/禁用功能
- 为 GraphRAG 缓存统计和清除接口添加调用方日志记录

backend/api-gateway/src/main/java/com/datamate/gateway/security/PermissionRuleMatcher.java

@@ -50,6 +50,7 @@ public class PermissionRuleMatcher {
         addModuleRules(permissionRules, "/api/content-generation/**", "module:content-generation:use", "module:content-generation:use");
         addModuleRules(permissionRules, "/api/task-meta/**", "module:task-coordination:read", "module:task-coordination:write");
         addModuleRules(permissionRules, "/api/knowledge-graph/**", "module:knowledge-graph:read", "module:knowledge-graph:write");
+        addModuleRules(permissionRules, "/api/graphrag/**", "module:knowledge-base:read", "module:knowledge-base:write");
 
         permissionRules.add(new PermissionRule(READ_METHODS, "/api/auth/users/**", "system:user:manage"));
         permissionRules.add(new PermissionRule(WRITE_METHODS, "/api/auth/users/**", "system:user:manage"));

backend/services/knowledge-graph-service/src/main/java/com/datamate/knowledgegraph/application/GraphRelationService.java

@@ -178,8 +178,8 @@ public class GraphRelationService {
     public void deleteRelation(String graphId, String relationId) {
         validateGraphId(graphId);
 
-        // 确认关系存在
-        relationRepository.findByIdAndGraphId(relationId, graphId)
+        // 确认关系存在并保留关系两端实体 ID，用于精准缓存失效
+        RelationDetail detail = relationRepository.findByIdAndGraphId(relationId, graphId)
                 .orElseThrow(() -> BusinessException.of(KnowledgeGraphErrorCode.RELATION_NOT_FOUND));
 
         long deleted = relationRepository.deleteByIdAndGraphId(relationId, graphId);
@@ -187,7 +187,11 @@ public class GraphRelationService {
             throw BusinessException.of(KnowledgeGraphErrorCode.RELATION_NOT_FOUND);
         }
         log.info("Relation deleted: id={}, graphId={}", relationId, graphId);
-        cacheService.evictEntityCaches(graphId, relationId);
+        cacheService.evictEntityCaches(graphId, detail.getSourceEntityId());
+        if (detail.getTargetEntityId() != null
+                && !detail.getTargetEntityId().equals(detail.getSourceEntityId())) {
+            cacheService.evictEntityCaches(graphId, detail.getTargetEntityId());
+        }
     }
 
     @Transactional

backend/services/knowledge-graph-service/src/main/java/com/datamate/knowledgegraph/application/GraphSyncService.java

@@ -296,7 +296,9 @@ public class GraphSyncService {
             resultMap.put("HAS_FIELD", stepService.mergeHasFieldRelations(graphId, syncId, changedEntityIds));
             resultMap.put("DERIVED_FROM", stepService.mergeDerivedFromRelations(graphId, syncId, changedEntityIds));
             if (!orgMapDegraded) {
-                resultMap.put("BELONGS_TO", stepService.mergeBelongsToRelations(graphId, userOrgMap, syncId, changedEntityIds));
+                // BELONGS_TO 依赖全量 userOrgMap，组织映射变更可能影响全部 User/Dataset。
+                // 增量同步下也执行全量 BELONGS_TO 重建，避免漏更新。
+                resultMap.put("BELONGS_TO", stepService.mergeBelongsToRelations(graphId, userOrgMap, syncId));
             } else {
                 log.info("[{}] Skipping BELONGS_TO relation build due to degraded org map fetch", syncId);
                 resultMap.put("BELONGS_TO", SyncResult.builder().syncType("BELONGS_TO").build());

backend/services/knowledge-graph-service/src/main/java/com/datamate/knowledgegraph/application/GraphSyncStepService.java

@@ -584,21 +584,16 @@ public class GraphSyncStepService {
             return endResult(result);
         }
 
+        if (changedEntityIds != null) {
+            log.debug("[{}] BELONGS_TO rebuild ignores changedEntityIds(size={}) due to org map dependency",
+                    syncId, changedEntityIds.size());
+        }
+
         // User → Org（通过 userOrgMap 查找对应组织）
         List<GraphEntity> users = entityRepository.findByGraphIdAndType(graphId, "User");
-        if (changedEntityIds != null) {
-            users = users.stream()
-                    .filter(user -> changedEntityIds.contains(user.getId()))
-                    .toList();
-        }
 
         // Dataset → Org（通过创建者的组织）
         List<GraphEntity> datasets = entityRepository.findByGraphIdAndType(graphId, "Dataset");
-        if (changedEntityIds != null) {
-            datasets = datasets.stream()
-                    .filter(dataset -> changedEntityIds.contains(dataset.getId()))
-                    .toList();
-        }
 
         // 删除受影响实体的旧 BELONGS_TO 关系，避免组织变更后遗留过时关系
         Set<String> affectedEntityIds = new LinkedHashSet<>();

backend/services/knowledge-graph-service/src/test/java/com/datamate/knowledgegraph/application/GraphRelationServiceTest.java

@@ -263,7 +263,8 @@ class GraphRelationServiceTest {
         relationService.deleteRelation(GRAPH_ID, RELATION_ID);
 
         verify(relationRepository).deleteByIdAndGraphId(RELATION_ID, GRAPH_ID);
-        verify(cacheService).evictEntityCaches(GRAPH_ID, RELATION_ID);
+        verify(cacheService).evictEntityCaches(GRAPH_ID, SOURCE_ENTITY_ID);
+        verify(cacheService).evictEntityCaches(GRAPH_ID, TARGET_ENTITY_ID);
     }
 
     @Test