refactor: real pagination for app/dataset/skill list APIs

[ctlaltlaltc]

What

Push permission filtering for the three list APIs (/api/core/app/list, /api/core/dataset/list, /api/core/ai/skill/list) into MongoDB (readableQuery = $or[{_id ∈ myReadableIds}, {tmbId}]) with real skip/limit + countDocuments pagination, unified {list, total} response contract (pageNum/pageSize optional, default 1/50; skill keeps page/pageSize), and create-time sync of parent folder permissions so children created in authorized folders are immediately visible to collaborators.

Maintainer review follow-ups (implemented in this PR)

• Bitmask query optimization: ReadableRoleBitsMask (low 4 role bits, incl. App readChatLog); initListPerCtx now queries the caller's permission records with $bitsAnySet filtering for group/org records — tmb-direct records stay unfiltered to preserve the permission=0 nullish priority, with the equivalence documented in code. The team-wide roleList fetch is replaced by a page-scoped getResourceClbsMap (page items + their parents), dropping per-request permission reads from O(team records) to O(page records).
• Backfill for legacy data: admin route POST /api/admin/dataClean/backfillResourcePermissions (root auth, dry-run by default, skipError/batch/concurrency options) materializes parent-folder collaborators onto children created before the create-sync fix, using the same merge semantics (getResourceOwnedClbs → syncCollaborators); idempotent, batched, and reports a nonReadableRoleRecords audit stat that validates the bitmask premise.

Verification

• 35+ Vitest cases: equivalence against the legacy JS-filter logic, pagination, create-sync materialization, bitmask behavior, backfill (materialization / idempotency / dry-run / inheritPermission=false skip / audit), helper units — all green; existing tests kept passing
• E2E on a dev server + browser: scroll pagination on all three list pages, curl contract checks (with/without pagination params both return {list,total} with default first page 50), cross-folder search, folder-collaborator sees a newly created child immediately; backfill verified on a real database (dry-run → write → idempotent re-check, audit 0)
• Two bugs found & fixed during implementation:
  • search branch: searchMatch.$or spread clobbered the permission $or (pre-existing, masked by full-set JS filter) — merged with $and
  • app/dataset create: creator owner record inserted outside the transaction, conflicting with the new in-transaction sync (WriteConflict 112) — session added

Follow-up (not in this PR)

The following list APIs still use full-fetch + JS filter / no pagination. They will be addressed in follow-up submissions:

• /api/support/mcp/list — full team MCP key fetch, no pagination
• /api/core/plugin/team/tool/list (and the admin variant) — full tool list + JS filter, no pagination
• /api/support/openapi/list — full fetch + in-memory filter/sort (low priority: key count capped at 100; in-memory key-fragment search is intentional)
• /api/core/app/template/list — full fetch + JS filter (low priority)
• /api/support/outLink/list — full per-app fetch (low priority)

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	19.95%	1765 / 8847
🔵	Statements	19.94%	1855 / 9301
🔵	Functions	17.54%	372 / 2120
🔵	Branches	16.57%	833 / 5027

File Coverage

No changed files found.

Generated in workflow #2000 for commit 9dd1950 by the Vitest Coverage Report Action

[github-actions]

✅ Admin Preview Image Ready!

ghcr.io/labring/fastgpt-pr:admin_9dd19509d0c33f809083d5b20009e29c01f9d6c4

🕒 Time: 2026-08-05 17:51:05 (UTC+8)

[github-actions]

✅ Docs Preview Deployed!

🔗 👀 Click here to visit preview

ghcr.io/labring/fastgpt-docs-pr:9dd19509d0c33f809083d5b20009e29c01f9d6c4

🕒 Time: 2026-08-05 17:44:14 (UTC+8)

[github-actions]

✅ Build Successful - Preview fastgpt Image for this PR:

ghcr.io/labring/fastgpt-pr:fastgpt_9dd19509d0c33f809083d5b20009e29c01f9d6c4

🕒 Time: 2026-08-05 17:54:00 (UTC+8)