feat: 增加差旅报销标准测算和财务终审流程

新增差旅报销测算接口及 Spreadsheet 规则解析，审批流程拆分
直属领导审批与财务终审两阶段并细分权限，修复 PDF 文本层
缺失时自动回退 OCR，提交后清理关联会话，前端适配审批流
交互并补充单元测试。

web/tests/accessControl.test.mjs

@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
 
-import { canManageExpenseClaims, canReturnExpenseClaims } from '../src/utils/accessControl.js'
+import {
+  canApproveLeaderExpenseClaims,
+  canManageExpenseClaims,
+  canReturnExpenseClaims
+} from '../src/utils/accessControl.js'
+import { canProcessApprovalRequest } from '../src/utils/approvalInbox.js'
 
 test('direct approvers can return claims without receiving delete permissions', () => {
   const managerUser = { roleCodes: ['manager'] }
@@ -9,13 +14,42 @@ test('direct approvers can return claims without receiving delete permissions',
 
   assert.equal(canReturnExpenseClaims(managerUser), true)
   assert.equal(canReturnExpenseClaims(approverUser), true)
+  assert.equal(canApproveLeaderExpenseClaims(managerUser), true)
+  assert.equal(canApproveLeaderExpenseClaims(approverUser), true)
   assert.equal(canManageExpenseClaims(managerUser), false)
   assert.equal(canManageExpenseClaims(approverUser), false)
 })
 
-test('finance and executives can return and manage claims', () => {
+test('finance can return and final approve, but only executives can manage delete permissions', () => {
   assert.equal(canReturnExpenseClaims({ roleCodes: ['finance'] }), true)
-  assert.equal(canManageExpenseClaims({ roleCodes: ['finance'] }), true)
+  assert.equal(canApproveLeaderExpenseClaims({ roleCodes: ['finance'] }), false)
+  assert.equal(canManageExpenseClaims({ roleCodes: ['finance'] }), false)
   assert.equal(canReturnExpenseClaims({ roleCodes: ['executive'] }), true)
   assert.equal(canManageExpenseClaims({ roleCodes: ['executive'] }), true)
 })
+
+test('finance approval inbox only processes finance-stage requests', () => {
+  const financeUser = { roleCodes: ['finance'], name: '财务' }
+
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '财务审批', person: '张三' }, financeUser),
+    true
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '直属领导审批', person: '张三' }, financeUser),
+    false
+  )
+})
+
+test('users with both finance and manager roles can process both relevant stages', () => {
+  const financeManagerUser = { roleCodes: ['finance', 'manager'], name: '李经理' }
+
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '财务审批', person: '张三' }, financeManagerUser),
+    true
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '直属领导审批', person: '张三' }, financeManagerUser),
+    true
+  )
+})