完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/src/routes/apOperations.js

@@ -10,7 +10,7 @@ const {
   listFinanceLedger,
 } = require("../services/financeLedger");
 
-const FINANCE_LEDGER_PERMISSION_CODES = ["payment.batch.manage", "risk.review.manage", "expense.finance.pay"];
+const FINANCE_LEDGER_PERMISSION_CODES = ["payment.batch.manage", "payment.batch.review", "risk.review.manage", "expense.finance.pay"];
 
 const FINANCE_LEDGER_QUERY_SCHEMA = z.object({
   page: z.coerce.number().int().min(1).optional(),