fix: 后台接口补全 @BackendPermission 权限注解

修复以下接口未声明 slug 导致低权限管理员可越权调用：
- POST /backend/v1/user/store-batch 批量导入学员 -> USER_STORE
- PUT  /backend/v1/course/{courseId}/attachment/update/sort -> COURSE
- PUT  /backend/v1/course/{courseId}/chapter/update/sort    -> COURSE
- PUT  /backend/v1/course/{courseId}/hour/update/sort       -> COURSE

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseAttachmentController.java

@@ -141,6 +141,7 @@ public class CourseAttachmentController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-附件-排序调整", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseChapterController.java

@@ -95,6 +95,7 @@ public class CourseChapterController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-章节-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/CourseHourController.java

@@ -224,6 +224,7 @@ public class CourseHourController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.COURSE)
     @PutMapping("/update/sort")
     @Log(title = "线上课-课时-更新排序", businessType = BusinessTypeConstant.UPDATE)
     public JsonResponse updateSort(

playedu-api/playedu-api/src/main/java/xyz/playedu/api/controller/backend/UserController.java

@@ -262,6 +262,7 @@ public class UserController {
         return JsonResponse.success();
     }
 
+    @BackendPermission(slug = BPermissionConstant.USER_STORE)
     @PostMapping("/store-batch")
     @Transactional
     @Log(title = "学员-批量导入", businessType = BusinessTypeConstant.INSERT)