feat: 新增预算费控模型与报销审批流引擎

后端新增预算费控服务和报销单审批流模块，引入申请人费用画像
算法，优化知识库 RAG 运行时和同步逻辑，完善报销单工作流常
量和明细同步，更新差旅报销规则电子表格，前端新增预算分析
组件和数字员工模型，完善审批对话框和洞察面板交互，优化侧
边栏和顶栏样式，补充单元测试。

web/tests/accessControl.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 
 import {
+  canApproveBudgetExpenseApplications,
   canApproveLeaderExpenseClaims,
   canAccessAppView,
   canDeleteArchivedExpenseClaims,
@@ -22,6 +23,24 @@ test('direct approvers can return claims without receiving delete permissions',
   assert.equal(canReturnExpenseClaims(approverUser), true)
   assert.equal(canApproveLeaderExpenseClaims(managerUser), true)
   assert.equal(canApproveLeaderExpenseClaims(approverUser), true)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['budget_monitor'], grade: 'P6' }), false)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['budget_monitor'], grade: 'P8' }), true)
+  assert.equal(
+    canApproveBudgetExpenseApplications(
+      { roleCodes: ['budget_monitor'], grade: 'P8', departmentName: '交付部' },
+      { departmentName: '交付部' }
+    ),
+    true
+  )
+  assert.equal(
+    canApproveBudgetExpenseApplications(
+      { roleCodes: ['budget_monitor'], grade: 'P8', departmentName: '财务部' },
+      { departmentName: '交付部' }
+    ),
+    false
+  )
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: [], grade: 'P8' }), false)
+  assert.equal(canApproveBudgetExpenseApplications({ roleCodes: ['executive'] }), true)
   assert.equal(canManageExpenseClaims(managerUser), false)
   assert.equal(canManageExpenseClaims(approverUser), false)
 })
@@ -81,6 +100,37 @@ test('finance approval inbox only processes finance-stage requests', () => {
   )
 })
 
+test('budget approval inbox only processes budget-stage requests for budget monitor or senior finance roles', () => {
+  const budgetUser = { roleCodes: ['budget_monitor'], grade: 'P8', name: '赵预算', departmentName: '交付部' }
+  const otherDepartmentBudgetUser = { roleCodes: ['budget_monitor'], grade: 'P8', name: '王预算', departmentName: '财务部' }
+  const seniorFinanceUser = { roleCodes: ['executive'], grade: 'P7', name: '高级财务' }
+  const p8WithoutBudgetRole = { roleCodes: ['manager'], grade: 'P8', name: '高职级经理' }
+
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '预算管理者审批', person: '张三', departmentName: '交付部' }, budgetUser),
+    true
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '预算管理者审批', person: '张三', departmentName: '交付部' }, seniorFinanceUser),
+    true
+  )
+  assert.equal(
+    canProcessApprovalRequest(
+      { workflowNode: '预算管理者审批', person: '张三', departmentName: '交付部' },
+      otherDepartmentBudgetUser
+    ),
+    false
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '预算管理者审批', person: '张三' }, p8WithoutBudgetRole),
+    false
+  )
+  assert.equal(
+    canProcessApprovalRequest({ workflowNode: '财务审批', person: '张三' }, budgetUser),
+    false
+  )
+})
+
 test('users with both finance and manager roles can process both relevant stages', () => {
   const financeManagerUser = { roleCodes: ['finance', 'manager'], name: '李经理' }