feat: 扩展风险规则体系、审批动态路由与预算中心列表化改造

- 新增 25+ 条风险规则（预算/报销/申请/通用类），完善风险规则模拟与反馈发布机制
- 引入费用审批动态路由、平台风险分级、预审与风险阶段管理
- 预算中心列表化改造，优化票据夹仪表盘与数字员工工作看板
- 新增 Hermes 风险线索收集器、Agent 链路追踪中心
- 扩展数字员工能力库（18 个领域 Skill）与交通费用自动预估
- 完善报销申请快速预览、权限控制与前端测试覆盖

server/tests/test_risk_rule_template_catalog.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+from app.main import create_app
+from app.services.risk_rule_dsl_validator import validate_risk_rule_draft
+from app.services.risk_rule_generation_interpreter import COMPOSITE_RULE_TEMPLATE_KEY
+from app.services.risk_rule_generation_ontology import FIELD_ONTOLOGY
+from app.services.risk_rule_template_catalog import (
+    list_risk_rule_template_groups,
+    list_risk_rule_templates,
+)
+
+
+def test_risk_rule_template_catalog_groups_and_dsl_examples() -> None:
+    groups = list_risk_rule_template_groups()
+    templates = list_risk_rule_templates()
+
+    assert [group["group"] for group in groups] == [
+        "budget",
+        "invoice",
+        "travel",
+        "entertainment",
+        "procurement_ap",
+        "corporate_card",
+        "general",
+    ]
+    assert len(templates) >= 8
+
+    for group in groups:
+        assert group["templates"], group["group"]
+
+    for template in templates:
+        assert template["title"]
+        assert template["natural_language"]
+        assert isinstance(template["requires_attachment"], bool)
+        assert template["fields"]
+        assert all("[" in field["display"] and "]" in field["display"] for field in template["fields"])
+        assert template["dsl_example"]["template_key"] == COMPOSITE_RULE_TEMPLATE_KEY
+
+        normalized = validate_risk_rule_draft(
+            template["dsl_example"]["params"],
+            fields=list(FIELD_ONTOLOGY),
+            natural_language=template["natural_language"],
+        )
+        assert normalized["template_key"] == COMPOSITE_RULE_TEMPLATE_KEY
+        assert normalized["dsl_validation"]["status"] == "passed"
+        assert normalized["conditions"]
+
+
+def test_risk_rule_template_endpoint_requires_login_and_returns_groups() -> None:
+    client = TestClient(create_app())
+
+    unauthorized = client.get("/api/v1/agent-assets/risk-rules/templates")
+    assert unauthorized.status_code == 401
+
+    response = client.get(
+        "/api/v1/agent-assets/risk-rules/templates",
+        headers={"x-auth-username": "finance", "x-auth-role-codes": "finance"},
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload[0]["group"] == "budget"
+    assert payload[0]["templates"][0]["dsl_example"]["params"]["conditions"]