fix: 取消CEO默认AP台账权限（09-07-manager-ap-access-scope）

.trellis/spec/hyb-oa/security-privacy.md

@@ -32,7 +32,7 @@ AP financial summary and reimbursement ledger reads, not general entity visibili
 
 ### 3. Contracts
 
-Grant ledger reading to `ceo`, `finance`, `finance_mgr`, not `manager` or
+Grant ledger reading to `finance`, `finance_mgr`, not `ceo`, `manager` or
 `system_admin`. Preserve emergency `admin` wildcard semantics. Both reads require
 the dedicated permission before data queries; query filters cannot confer access.
 Frontend route and navigation projections use the same permission. Keep manager
@@ -44,13 +44,13 @@ management to preserve read access. Export keeps its existing independent
 
 Feature enabled: missing ledger permission returns 403 / `PERM_001`, with no
 financial query. Feature disabled: the existing 409 refusal may occur first.
-CEO/finance/finance manager and manager+finance retain reading. Old payment or
+Finance/finance manager and manager+finance or ceo+finance retain reading. CEO alone is refused. Old payment or
 risk permissions alone no longer imply ledger reading.
 
 ### 5. Good / Base / Bad Cases
 
 - Base: manager keeps payment review but cannot enter AP.
-- Good: CEO reads AP without acquiring export or payment-write rights.
+- Good: CEO retains approval and payment review but cannot read AP without a separate finance role.
 - Bad: hiding a menu while leaving either backend read unrestricted.
 
 ### 6. Tests Required