fix: 彻底解耦出库/借库权限联动 + 路由去硬编码roles + 补API权限保护

根因: 借库选单页面14处硬编码outbound_selection:operation, 导致两模块权限联动

修复:
- borrow/apply: 14处outbound_selection:operation→op_borrow_apply:operation
- stock.py: 拆分_do_get_stock_list裸逻辑, 出库/借库各绑独立权限码
- transactions: 新增/borrow/stock-list端点(@permission(op_borrow_apply))
- transaction.ts: 新增getBorrowStockList前端API函数
- outbound.py: 出库审批4端点改用独立outbound_approval权限码
- transactions.py: 借库审批3端点补@permission(op_borrow_approval)
- purchase.py: 采购管理7端点补@permission(inbound_buy)
- audit.py: 审计日志补@permission(system_audit)
- router: 清除全部6处硬编码roles, 交由动态权限树控制

inventory-web/src/router/index.ts

@@ -164,8 +164,7 @@ const routes: Array<RouteRecordRaw> = [
                 component: () => import('@/views/outbound/approval/index.vue'),
                 meta: {
                     title: '出库审批',
-                    icon: 'Stamp',
-                    roles: ['SUPER_ADMIN', 'SUPERVISOR']
+                    icon: 'Stamp'
                 }
             }
         ]
@@ -239,8 +238,7 @@ const routes: Array<RouteRecordRaw> = [
                 component: () => import('@/views/borrow/approval/index.vue'),
                 meta: {
                     title: '借库审批',
-                    icon: 'Stamp',
-                    roles: ['SUPER_ADMIN', 'SUPERVISOR']
+                    icon: 'Stamp'
                 }
             }
         ]
@@ -276,9 +274,7 @@ const routes: Array<RouteRecordRaw> = [
         redirect: '/system/user-create',
         meta: {
             title: '系统管理',
-            icon: 'Setting',
-            // [修复] 使用大写角色名，匹配后端常量
-            roles: ['SUPER_ADMIN', 'SUPERVISOR']
+            icon: 'Setting'
         },
         children: [
             {
@@ -287,8 +283,7 @@ const routes: Array<RouteRecordRaw> = [
                 component: () => import('@/views/system/UserCreate.vue'),
                 meta: {
                     title: '账号开通',
-                    icon: 'User',
-                    roles: ['SUPER_ADMIN', 'SUPERVISOR']
+                    icon: 'User'
                 }
             },
             // [新增] 权限分配页面，只有超级管理员可进
@@ -298,8 +293,7 @@ const routes: Array<RouteRecordRaw> = [
                 component: () => import('@/views/system/PermissionConfig.vue'),
                 meta: {
                     title: '权限分配',
-                    icon: 'Lock',
-                    roles: ['SUPER_ADMIN', 'SUPERVISOR']
+                    icon: 'Lock'
                 }
             },
             {
@@ -308,8 +302,7 @@ const routes: Array<RouteRecordRaw> = [
                 component: () => import('@/views/system/AuditLog.vue'),
                 meta: {
                     title: '审计日志',
-                    icon: 'Document',
-                    roles: ['SUPER_ADMIN', 'SUPERVISOR']
+                    icon: 'Document'
                 }
             }
         ]