feat: 扩展风险规则体系、审批动态路由与预算中心列表化改造

- 新增 25+ 条风险规则（预算/报销/申请/通用类），完善风险规则模拟与反馈发布机制
- 引入费用审批动态路由、平台风险分级、预审与风险阶段管理
- 预算中心列表化改造，优化票据夹仪表盘与数字员工工作看板
- 新增 Hermes 风险线索收集器、Agent 链路追踪中心
- 扩展数字员工能力库（18 个领域 Skill）与交通费用自动预估
- 完善报销申请快速预览、权限控制与前端测试覆盖

web/src/services/api.js

@@ -1,3 +1,5 @@
+import { normalizeAuthUserSnapshot } from '../utils/authUser.js'
+
 const API_BASE_STORAGE_KEY = 'x-financial-api-base-url'
 const AUTH_USER_STORAGE_KEY = 'x-financial-auth-user'
 
@@ -43,16 +45,25 @@ function readCurrentUserHeaders() {
 
   try {
     const payload = JSON.parse(raw)
-    const username = String(payload?.username || '').trim()
-    const name = String(payload?.name || username).trim()
-    const roleCodes = Array.isArray(payload?.roleCodes) ? payload.roleCodes.filter(Boolean) : []
+    const user = normalizeAuthUserSnapshot(payload)
+    const username = user.username
+    const name = user.name || username
+    const roleCodes = user.roleCodes
     const isAdmin = resolveStoredUserAdminFlag(payload, roleCodes)
-    const department = String(payload?.department || payload?.departmentName || '').trim()
-    const costCenter = String(payload?.costCenter || payload?.cost_center || '').trim()
+    const department = user.department || user.departmentName
+    const costCenter = user.costCenter
+    const position = user.position
+    const grade = user.grade
+    const employeeNo = user.employeeNo
+    const managerName = user.managerName
     const safeUsername = pickSafeHeaderValue(username)
     const safeName = pickSafeHeaderValue(name)
     const safeDepartment = pickSafeHeaderValue(department)
     const safeCostCenter = pickSafeHeaderValue(costCenter)
+    const safePosition = pickSafeHeaderValue(position)
+    const safeGrade = pickSafeHeaderValue(grade)
+    const safeEmployeeNo = pickSafeHeaderValue(employeeNo)
+    const safeManagerName = pickSafeHeaderValue(managerName)
 
     if (!safeUsername && !safeName) {
       return {}
@@ -79,6 +90,22 @@ function readCurrentUserHeaders() {
       headers['x-auth-cost-center'] = safeCostCenter
     }
 
+    if (safePosition) {
+      headers['x-auth-position'] = safePosition
+    }
+
+    if (safeGrade) {
+      headers['x-auth-grade'] = safeGrade
+    }
+
+    if (safeEmployeeNo) {
+      headers['x-auth-employee-no'] = safeEmployeeNo
+    }
+
+    if (safeManagerName) {
+      headers['x-auth-manager-name'] = safeManagerName
+    }
+
     return headers
   } catch {
     return {}