feat(client): 初始化前端壳与鉴权守卫（P1-5）

- 技术栈：React 18 + TypeScript + Vite + Tailwind

- API 层：ApiError + 401 自动刷新 + single-flight 重试

- 鉴权：内存 Access Token + Cookie Refresh + 启动 bootstrap

- RBAC：权限映射 + RequireAuth/RequirePermission 路由守卫

- 布局：OA 工作台壳层 + 侧边栏 + 5 个占位页面

- 样式：复用 hyb-web 视觉 token（单向同步）

- 文档：新增 client README，补充 server 联调说明

client/src/pages/DashboardPage.tsx

@@ -0,0 +1,77 @@
+import { Link } from "react-router-dom";
+import { EmptyStateCard } from "../components/common/EmptyStateCard";
+import { PageHeader } from "../components/common/PageHeader";
+import { useAuth } from "../auth/AuthContext";
+
+export function DashboardPage() {
+  const { me, permissions } = useAuth();
+
+  return (
+    <div>
+      <PageHeader
+        title="仪表盘"
+        subtitle="前端壳已完成初始化，后续业务模块将在此基础上扩展。"
+      />
+
+      <div className="grid gap-4 lg:grid-cols-2">
+        <section className="card-std">
+          <h3 className="card-title">当前用户</h3>
+          <dl className="space-y-2 text-sm text-slate-700">
+            <div className="flex justify-between gap-3">
+              <dt className="text-secondary">姓名</dt>
+              <dd className="font-medium text-slate-900">{me?.name ?? "-"}</dd>
+            </div>
+            <div className="flex justify-between gap-3">
+              <dt className="text-secondary">员工号</dt>
+              <dd className="font-medium text-slate-900">{me?.employeeNo ?? "-"}</dd>
+            </div>
+            <div className="flex justify-between gap-3">
+              <dt className="text-secondary">邮箱</dt>
+              <dd className="font-medium text-slate-900">{me?.email ?? "-"}</dd>
+            </div>
+            <div className="flex justify-between gap-3">
+              <dt className="text-secondary">角色</dt>
+              <dd className="font-medium text-slate-900">{me?.roleCodes?.join(" / ") ?? "-"}</dd>
+            </div>
+          </dl>
+        </section>
+
+        <section className="card-std">
+          <h3 className="card-title">权限摘要</h3>
+          {permissions.length ? (
+            <div className="flex flex-wrap gap-2">
+              {permissions.map((permission) => (
+                <span
+                  className="rounded-full bg-primary-50 px-2.5 py-1 text-xs font-medium text-primary"
+                  key={permission}
+                >
+                  {permission}
+                </span>
+              ))}
+            </div>
+          ) : (
+            <p className="card-desc">暂无权限信息。</p>
+          )}
+        </section>
+      </div>
+
+      <div className="mt-4 grid gap-4 lg:grid-cols-3">
+        <EmptyStateCard
+          title="我的报销"
+          description="下一阶段接入报销列表与详情。"
+          footer={<Link className="text-sm font-medium text-primary" to="/reimbursements">进入页面</Link>}
+        />
+        <EmptyStateCard
+          title="待我处理"
+          description="下一阶段接入 workflow 待办列表与动作。"
+          footer={<Link className="text-sm font-medium text-primary" to="/workflow/tasks">进入页面</Link>}
+        />
+        <EmptyStateCard
+          title="票据中心"
+          description="下一阶段接入上传、签名 URL 与绑定流程。"
+          footer={<Link className="text-sm font-medium text-primary" to="/invoice-pool">进入页面</Link>}
+        />
+      </div>
+    </div>
+  );
+}