fix: 取消CEO默认AP台账权限（09-07-manager-ap-access-scope）

server/tests/unit/constants/permissions.test.js

@@ -6,13 +6,18 @@ const {
 
 describe("Permission Constants", () => {
   it("separates full AP reading from payment review and preserves multi-role grants", () => {
-    for (const role of ["ceo", "finance", "finance_mgr"]) {
+    for (const role of ["finance", "finance_mgr"]) {
       expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(true);
     }
-    for (const role of ["manager", "employee", "system_admin", "hr", "administration"]) {
+    for (const role of ["ceo", "manager", "employee", "system_admin", "hr", "administration"]) {
       expect(hasPermission(resolvePermissionsForRoles([role]), "finance.ledger.view")).toBe(false);
     }
-    expect(hasPermission(resolvePermissionsForRoles(["manager", "finance"]), "finance.ledger.view")).toBe(true);
+    for (const role of ["manager", "ceo"]) {
+      expect(hasPermission(resolvePermissionsForRoles([role, "finance"]), "finance.ledger.view")).toBe(true);
+      for (const permission of ["expense.approve", "leave.approve", "attendance.approve", "procurement.approve", "payment.batch.review"]) {
+        expect(hasPermission(resolvePermissionsForRoles([role]), permission)).toBe(true);
+      }
+    }
     expect(hasPermission(resolvePermissionsForRoles(["manager"]), "payment.batch.review")).toBe(true);
     expect(hasPermission(resolvePermissionsForRoles(["ceo"]), "payment.batch.manage")).toBe(false);
   });