feat: 完善审批退回流程与报销申请关联

后端优化报销单访问策略和常量定义，增强退回原因和审批状态
流转，前端完善退回对话框和审批交互组件，新增报销申请关联
模型，优化文档中心行数据和审批收件箱工具函数，增强引导
流程和会话模型，补充单元测试覆盖。

web/tests/application-approval-info.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 
 import {
+  buildLeaderApprovalEvents,
   buildLeaderApprovalInfo,
   resolveGeneratedDraftClaimNo
 } from '../src/utils/applicationApproval.js'
@@ -52,3 +53,56 @@ test('resolveGeneratedDraftClaimNo reads approval response payload', () => {
     'EXP-202605-0012'
   )
 })
+
+test('buildLeaderApprovalEvents returns leader return and approval timeline in event order', () => {
+  const events = buildLeaderApprovalEvents({
+    profileManager: 'Fallback Manager',
+    riskFlags: [
+      {
+        source: 'manual_approval',
+        event_type: 'expense_application_approval',
+        operator: 'Leader Li',
+        opinion: 'Approved after supplement.',
+        approval_event_id: 'approval-1',
+        created_at: '2026-05-25T11:00:00'
+      },
+      {
+        source: 'manual_return',
+        event_type: 'expense_application_return',
+        operator: 'manager@example.com',
+        operator_name: 'Leader Li',
+        reason: 'Need clearer budget explanation.',
+        return_count: 1,
+        return_event_id: 'return-1',
+        created_at: '2026-05-25T09:00:00'
+      }
+    ]
+  })
+
+  assert.deepEqual(events.map((event) => event.id), ['return-1', 'approval-1'])
+  assert.deepEqual(events.map((event) => event.type), ['returned', 'approved'])
+  assert.deepEqual(events.map((event) => event.tone), ['danger', 'success'])
+  assert.equal(events[0].operator, 'Leader Li')
+  assert.equal(events[0].opinion, 'Need clearer budget explanation.')
+  assert.equal(events[0].returnCount, 1)
+  assert.equal(events[0].time, '2026-05-25 09:00')
+  assert.equal(Object.hasOwn(events[0], 'sortAt'), false)
+})
+
+test('buildLeaderApprovalEvents hides empty or unrelated return state', () => {
+  assert.deepEqual(buildLeaderApprovalEvents({ riskFlags: [] }), [])
+  assert.deepEqual(
+    buildLeaderApprovalEvents({
+      riskFlags: [
+        {
+          source: 'manual_return',
+          event_type: 'expense_claim_return',
+          return_stage_key: 'finance',
+          reason: 'Finance return should not render as leader application opinion.',
+          created_at: '2026-05-25T09:00:00'
+        }
+      ]
+    }),
+    []
+  )
+})