feat: 新增预算后端服务与差旅风险规则库

后端新增预算模型、端点和服务模块，支持预算 CRUD 和余额
查询，清理旧生成规则文件并替换为按严重等级分类的差旅风
险规则库，优化认证权限和报销单访问策略，新增财务规则目
录和演示数据构建脚本，前端预算中心增加对话框交互，完善
审计页面运行时模型和元数据展示，补充单元测试。

server/src/app/services/employee.py

@@ -128,6 +128,7 @@ class EmployeeService:
             for status in STATUS_ORDER
         ]
 
+        visible_role_codes = {item["role_code"] for item in ROLE_DEFINITIONS}
         role_options = [
             EmployeeRoleOptionRead(
                 id=role.role_code,
@@ -137,6 +138,7 @@ class EmployeeService:
                 permissions=list(ROLE_PERMISSION_MAP.get(role.role_code, [])),
             )
             for role in self._sorted_roles(self.repository.list_roles())
+            if role.role_code in visible_role_codes
         ]
 
         canonical_department_codes = set(CANONICAL_DEPARTMENT_CODES)
@@ -470,6 +472,11 @@ class EmployeeService:
 
     def _seed_roles(self) -> None:
         existing_by_code = {role.role_code: role for role in self.repository.list_roles()}
+        legacy_auditor = existing_by_code.get("auditor")
+        if legacy_auditor is not None and "budget_monitor" not in existing_by_code:
+            legacy_auditor.role_code = "budget_monitor"
+            existing_by_code["budget_monitor"] = legacy_auditor
+            existing_by_code.pop("auditor", None)
 
         for definition in ROLE_DEFINITIONS:
             role = existing_by_code.get(definition["role_code"])
@@ -481,6 +488,9 @@ class EmployeeService:
                 )
                 self.db.add(role)
                 existing_by_code[role.role_code] = role
+            else:
+                role.name = definition["name"]
+                role.description = definition["description"]
 
         self.db.flush()