feat: 扩展风险规则体系、审批动态路由与预算中心列表化改造

- 新增 25+ 条风险规则（预算/报销/申请/通用类），完善风险规则模拟与反馈发布机制
- 引入费用审批动态路由、平台风险分级、预审与风险阶段管理
- 预算中心列表化改造，优化票据夹仪表盘与数字员工工作看板
- 新增 Hermes 风险线索收集器、Agent 链路追踪中心
- 扩展数字员工能力库（18 个领域 Skill）与交通费用自动预估
- 完善报销申请快速预览、权限控制与前端测试覆盖

web/src/utils/accessControl.js

@@ -151,29 +151,46 @@ export function canApproveLeaderExpenseClaims(user) {
   return normalizedRoleCodes(user).some((roleCode) => CLAIM_LEADER_APPROVAL_ROLE_CODES.has(roleCode))
 }
 
-export function canApproveBudgetExpenseApplications(user, request = null) {
-  if (isPlatformAdminUser(user)) {
-    return true
-  }
-
-  const roleCodes = normalizedRoleCodes(user)
-  if (roleCodes.includes('executive')) {
-    return true
-  }
-  if (!roleCodes.includes('budget_monitor')) {
-    return false
-  }
-  if (normalizedGrade(user) !== CLAIM_BUDGET_APPROVAL_GRADE) {
-    return false
-  }
+export function canApproveBudgetExpenseApplications(user, request = null) {
+  if (isPlatformAdminUser(user)) {
+    return true
+  }
+
+  const roleCodes = normalizedRoleCodes(user)
+  if (!roleCodes.some((roleCode) => roleCode === 'budget_monitor' || roleCode === 'executive')) {
+    return false
+  }
+  if (normalizedGrade(user) !== CLAIM_BUDGET_APPROVAL_GRADE) {
+    return false
+  }
 
   return request ? departmentIntersects(request, user) : true
 }
 
-export function isCurrentRequestApplicant(request, user) {
-  const applicantNames = collectIdentityNames(
-    request?.person,
-    request?.employeeName,
+export function isCurrentRequestApplicant(request, user) {
+  const applicantIds = collectIdentityNames(
+    request?.employeeId,
+    request?.employee_id,
+    request?.profileEmployeeId,
+    request?.employeeNo,
+    request?.employee_no
+  )
+  const currentIds = collectIdentityNames(
+    user?.id,
+    user?.employeeId,
+    user?.employee_id,
+    user?.employeeNo,
+    user?.employee_no,
+    user?.username,
+    user?.email
+  )
+  if (applicantIds.length > 0 && identityIntersects(applicantIds, currentIds)) {
+    return true
+  }
+
+  const applicantNames = collectIdentityNames(
+    request?.person,
+    request?.employeeName,
     request?.employee_name,
     request?.profileName,
     request?.applicant