feat: 扩展风险规则体系、审批动态路由与预算中心列表化改造

- 新增 25+ 条风险规则（预算/报销/申请/通用类），完善风险规则模拟与反馈发布机制
- 引入费用审批动态路由、平台风险分级、预审与风险阶段管理
- 预算中心列表化改造，优化票据夹仪表盘与数字员工工作看板
- 新增 Hermes 风险线索收集器、Agent 链路追踪中心
- 扩展数字员工能力库（18 个领域 Skill）与交通费用自动预估
- 完善报销申请快速预览、权限控制与前端测试覆盖

web/tests/accessControl.test.mjs

@@ -40,7 +40,9 @@ test('direct approvers can return claims without receiving delete permissions',
     false
   )
   assert.equal(canApproveBudgetExpenseApplications({ roleCodes: [], grade: 'P8' }), false)
-  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['executive'] }), true)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['executive'] }), false)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['executive'], grade: 'P7' }), false)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['executive'], grade: 'P8' }), true)
   assert.equal(canManageExpenseClaims(managerUser), false)
   assert.equal(canManageExpenseClaims(approverUser), false)
 })
@@ -101,10 +103,11 @@ test('finance approval inbox only processes finance-stage requests', () => {
   )
 })
 
-test('budget approval inbox only processes budget-stage requests for budget monitor or senior finance roles', () => {
+test('budget approval inbox only processes budget-stage requests for department P8 budget approvers', () => {
   const budgetUser = { roleCodes: ['budget_monitor'], grade: 'P8', name: '赵预算', departmentName: '交付部' }
   const otherDepartmentBudgetUser = { roleCodes: ['budget_monitor'], grade: 'P8', name: '王预算', departmentName: '财务部' }
   const seniorFinanceUser = { roleCodes: ['executive'], grade: 'P7', name: '高级财务' }
+  const p8ExecutiveBudgetUser = { roleCodes: ['executive'], grade: 'P8', name: 'P8 Executive', departmentName: '交付部' }
   const p8WithoutBudgetRole = { roleCodes: ['manager'], grade: 'P8', name: '高职级经理' }
 
   assert.equal(
@@ -113,6 +116,10 @@ test('budget approval inbox only processes budget-stage requests for budget moni
   )
   assert.equal(
     canProcessApprovalRequest({ workflowNode: '预算管理者审批', person: '张三', departmentName: '交付部' }, seniorFinanceUser),
+    false
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '预算管理者审批', person: '张三', departmentName: '交付部' }, p8ExecutiveBudgetUser),
     true
   )
   assert.equal(
@@ -170,3 +177,35 @@ test('direct-manager approval helpers only match claims pushed to the current us
   assert.equal(isCurrentDirectManagerForRequest({ person: '张三', managerName: '李经理' }, managerUser), true)
   assert.equal(isCurrentDirectManagerForRequest({ person: '张三', managerName: '王总' }, managerUser), false)
 })
+
+test('applicant helper matches generated draft owner by employee identifiers', () => {
+  const currentUser = {
+    username: 'caoxiaozhu@xf.com',
+    email: 'caoxiaozhu@xf.com',
+    employeeNo: 'E90919',
+    name: '曹笑竹'
+  }
+
+  assert.equal(
+    isCurrentRequestApplicant(
+      {
+        employeeNo: 'E90919',
+        employeeName: '曹笑竹',
+        person: '曹笑竹'
+      },
+      currentUser
+    ),
+    true
+  )
+  assert.equal(
+    isCurrentRequestApplicant(
+      {
+        employeeNo: 'E10001',
+        employeeName: '张三',
+        person: '张三'
+      },
+      currentUser
+    ),
+    false
+  )
+})