feat(P11-P12): 落地治理开关与移动端MVP（G0-G6/H1/M1-M4）

- 新增 Feature Flag 模型、评估服务与管理 API（erp_sync/invoice_verification）\n- 完成 ERP 与验真灰度收口（路由/服务/作业统一判定）\n- 补齐 pay 与手动 sync 的 department_id 灰度上下文\n- 增加管理后台开关页、PWA 基础设施与移动拍照/审批页面\n- 增加回归脚本、安全基线与压测脚本，更新文档与执行合同\n\nIssue: G0,G1,G2,G3,G4,G5,G6,H1,M1,M2,M3,M4

server/src/services/verification/index.js

@@ -1,5 +1,6 @@
 const { runMockVerification } = require("./mock");
 const { runTaxVerification } = require("./tax");
+const { FEATURE_FLAG_KEYS, evaluateFeatureFlag } = require("../featureFlags");
 
 function getProvider(config) {
   return String(config.verificationProvider ?? "mock").trim().toLowerCase();
@@ -9,6 +10,28 @@ function isVerificationEnabled(config) {
   return Boolean(config.invoiceVerificationEnabled);
 }
 
+async function evaluateVerificationAccess({
+  prisma,
+  config,
+  departmentId = null,
+  strictDepartment = true,
+}) {
+  const evaluation = await evaluateFeatureFlag({
+    prisma,
+    config,
+    flagKey: FEATURE_FLAG_KEYS.invoiceVerification,
+    departmentId,
+    strictDepartment,
+  });
+
+  return {
+    enabled: evaluation.enabled,
+    reason: evaluation.reason,
+    matchedDepartmentId: evaluation.matchedDepartmentId,
+    envEnabled: evaluation.envEnabled,
+  };
+}
+
 async function verifyInvoiceByProvider({ config, invoice }) {
   const provider = getProvider(config);
 
@@ -33,5 +56,6 @@ async function verifyInvoiceByProvider({ config, invoice }) {
 module.exports = {
   getProvider,
   isVerificationEnabled,
+  evaluateVerificationAccess,
   verifyInvoiceByProvider,
 };

server/src/services/verification/tax.js

@@ -1,15 +1,4 @@
 async function runTaxVerification({ config, invoice }) {
-  if (!config.invoiceVerificationEnabled) {
-    return {
-      status: "error",
-      resultCode: "verification_disabled",
-      resultMessage: "invoice verification disabled",
-      payload: {
-        provider: "tax",
-      },
-    };
-  }
-
   return {
     status: "error",
     resultCode: "tax_provider_not_configured",