fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

client/src/auth/permissions.ts

@@ -68,6 +68,7 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "payment.batch.review",
   ],
   ceo: [
+    "finance.ledger.view",
     ...EMPLOYEE_BASE_PERMISSIONS,
     ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
     ...MASTERDATA_VIEW_PERMISSIONS,
@@ -86,6 +87,7 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "payment.batch.review",
   ],
   finance: [
+    "finance.ledger.view",
     ...EMPLOYEE_BASE_PERMISSIONS,
     ...MASTERDATA_VIEW_PERMISSIONS,
     "invoice.manage",
@@ -106,6 +108,7 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "payroll.manage",
   ],
   finance_mgr: [
+    "finance.ledger.view",
     ...EMPLOYEE_BASE_PERMISSIONS,
     ...MASTERDATA_MANAGE_PERMISSIONS,
     "invoice.manage",

client/src/components/navigation/NavLinks.tsx

@@ -38,7 +38,7 @@ export const NAV_ITEMS: NavItem[] = [
   { to: "/travel-requests", label: "差旅申请", icon: "flight", anyOf: ["travel.view_all", "travel.manage", "travel.payment.manage"] },
   { to: "/budgets", label: "预算管理", icon: "account_balance", anyOf: ["budget.view", "budget.manage"] },
   { to: "/payment-batches", label: "付款", icon: "payments", anyOf: ["payment.batch.manage", "risk.review.manage", "payment.batch.review"] },
-  { to: "/ap-operations", label: "应付账款", icon: "account_balance_wallet", anyOf: ["payment.batch.manage", "risk.review.manage", "payment.batch.review"] },
+  { to: "/ap-operations", label: "应付账款", icon: "account_balance_wallet", anyOf: ["finance.ledger.view"] },
   { to: "/invoice-pool", label: "票据", icon: "receipt_long", anyOf: ["invoice.manage"] },
   { to: "/inventory-checks", label: "资产盘点", icon: "inventory", anyOf: ["asset.inventory"] },
   { to: "/dashboard", label: "数据看板", icon: "dashboard", anyOf: ["report.dashboard.view"] },

client/src/router/index.tsx

@@ -315,7 +315,7 @@ const routeElements = (
         <Route
           path="ap-operations"
           element={
-            <RequirePermission anyOf={["payment.batch.manage", "risk.review.manage", "payment.batch.review"]}>
+            <RequirePermission anyOf={["finance.ledger.view"]}>
               {withRouteFallback(<ApOperationsPage />)}
             </RequirePermission>
           }