feat: 完善审批退回流程与报销申请关联

后端优化报销单访问策略和常量定义，增强退回原因和审批状态
流转，前端完善退回对话框和审批交互组件，新增报销申请关联
模型，优化文档中心行数据和审批收件箱工具函数，增强引导
流程和会话模型，补充单元测试覆盖。

web/tests/accessControl.test.mjs

@@ -6,6 +6,8 @@ import {
   canAccessAppView,
   canDeleteArchivedExpenseClaims,
   canEditBudgetCenter,
+  isCurrentDirectManagerForRequest,
+  isCurrentRequestApplicant,
   canManageExpenseClaims,
   canReturnExpenseClaims,
   canSwitchBudgetDepartments
@@ -87,7 +89,33 @@ test('users with both finance and manager roles can process both relevant stages
     true
   )
   assert.equal(
-    canProcessApprovalRequest({ workflowNode: '直属领导审批', person: '张三' }, financeManagerUser),
+    canProcessApprovalRequest(
+      { workflowNode: '直属领导审批', person: '张三', managerName: '李经理' },
+      financeManagerUser
+    ),
     true
   )
+  assert.equal(
+    canProcessApprovalRequest(
+      { workflowNode: '直属领导审批', person: '李经理', managerName: '王总' },
+      financeManagerUser
+    ),
+    false
+  )
+  assert.equal(
+    canProcessApprovalRequest(
+      { workflowNode: '直属领导审批', person: '张三', managerName: '王总' },
+      financeManagerUser
+    ),
+    false
+  )
+})
+
+test('direct-manager approval helpers only match claims pushed to the current user', () => {
+  const managerUser = { roleCodes: ['manager'], name: '李经理', username: 'manager@example.com' }
+
+  assert.equal(isCurrentRequestApplicant({ person: '李经理', managerName: '王总' }, managerUser), true)
+  assert.equal(isCurrentDirectManagerForRequest({ person: '李经理', managerName: '王总' }, managerUser), false)
+  assert.equal(isCurrentDirectManagerForRequest({ person: '张三', managerName: '李经理' }, managerUser), true)
+  assert.equal(isCurrentDirectManagerForRequest({ person: '张三', managerName: '王总' }, managerUser), false)
 })