feat: 新增风险图谱算法与系统仪表盘及操作反馈体系

后端新增风险图谱算法模块、风险观察与反馈服务、规则 DSL
校验器和可解释性引擎，完善系统仪表盘和财务仪表盘统计，
优化 agent 运行和编排执行链路，清理旧开发文档，前端新增
系统趋势、负载热力图等多种仪表盘图表组件，完善操作反馈
对话框和工作台日期选择器，优化报销创建和审批详情交互，
补充单元测试覆盖。

server/src/app/services/expense_claim_access_policy.py

@@ -591,27 +591,30 @@ class ExpenseClaimAccessPolicy:
         *,
         include_approval_scope: bool = False,
     ) -> Any:
-        if self.has_privileged_claim_access(current_user):
-            owned_conditions = self.build_personal_claim_conditions(current_user)
-            archived_condition = self.build_archived_claim_condition()
-            if owned_conditions:
-                return stmt.where(
+        conditions = self.build_personal_claim_conditions(current_user)
+
+        if include_approval_scope:
+            role_codes = self.normalize_role_codes(current_user)
+            if current_user.is_admin or "executive" in role_codes:
+                conditions.append(ExpenseClaim.status.in_(("submitted", PAYMENT_PENDING_STATUS, "returned")))
+            elif "finance" in role_codes:
+                conditions.append(
                     or_(
-                        ~archived_condition,
-                        and_(archived_condition, or_(*owned_conditions)),
+                        and_(
+                            ExpenseClaim.status == "submitted",
+                            ExpenseClaim.approval_stage == FINANCE_APPROVAL_STAGE,
+                        ),
+                        ExpenseClaim.status.in_((PAYMENT_PENDING_STATUS, "returned")),
                     )
                 )
-            return stmt.where(~archived_condition)
-
-        conditions = self.build_personal_claim_conditions(current_user)
+            conditions.extend(self.build_budget_approval_claim_conditions(current_user))
+            conditions.extend(self.build_approval_claim_conditions(current_user))
+            if self.has_archive_center_access(current_user):
+                conditions.append(self.build_archived_claim_condition())
 
         if not conditions:
             return stmt.where(ExpenseClaim.id == "__no_visible_claim__")
 
-        if include_approval_scope:
-            conditions.extend(self.build_budget_approval_claim_conditions(current_user))
-            conditions.extend(self.build_approval_claim_conditions(current_user))
-
         return stmt.where(or_(*conditions))
 
     def apply_archived_claim_scope(self, stmt: Any, current_user: CurrentUserContext) -> Any: