feat: 扩展风险规则体系、审批动态路由与预算中心列表化改造

- 新增 25+ 条风险规则（预算/报销/申请/通用类），完善风险规则模拟与反馈发布机制
- 引入费用审批动态路由、平台风险分级、预审与风险阶段管理
- 预算中心列表化改造，优化票据夹仪表盘与数字员工工作看板
- 新增 Hermes 风险线索收集器、Agent 链路追踪中心
- 扩展数字员工能力库（18 个领域 Skill）与交通费用自动预估
- 完善报销申请快速预览、权限控制与前端测试覆盖

server/tests/test_auth_service.py

@@ -23,11 +23,11 @@ def build_session() -> Session:
     return session_factory()
 
 
-def test_employee_can_login_with_seed_default_password() -> None:
-    with build_session() as db:
-        employee = EmployeeService(db).list_employees()[0]
-        result = AuthService(db).login(
-            LoginRequest(username=employee.email, password="123456")
+def test_employee_can_login_with_seed_default_password() -> None:
+    with build_session() as db:
+        employee = EmployeeService(db).list_employees()[0]
+        result = AuthService(db).login(
+            LoginRequest(username=employee.email, password="123456")
         )
 
         assert result.ok is True
@@ -36,10 +36,23 @@ def test_employee_can_login_with_seed_default_password() -> None:
         assert result.user.position == employee.position
         assert result.user.grade == employee.grade
         assert result.user.roleCodes
-        assert result.user.isAdmin is False
-
-
-def test_admin_can_login_with_database_password() -> None:
+        assert result.user.isAdmin is False
+
+
+def test_current_user_snapshot_refreshes_employee_position() -> None:
+    with build_session() as db:
+        employee = EmployeeService(db).list_employees()[0]
+        result = AuthService(db).get_user_snapshot(employee.email)
+
+        assert result is not None
+        assert result.username == employee.email
+        assert result.name == employee.name
+        assert result.department == employee.department
+        assert result.position == employee.position
+        assert result.grade == employee.grade
+
+
+def test_admin_can_login_with_database_password() -> None:
     with build_session() as db:
         settings_service = SettingsService(db)
         payload = settings_service.get_settings_snapshot().model_dump()