fix: semi/product submit 响应用 apply_strict_rbac 替代硬编码 resp.pop，成本字段纳入 RBAC 统一管控

inventory-backend/app/api/v1/inbound/semi.py

@@ -123,10 +123,8 @@ def submit():
                 if field in data and perm_code not in user_permissions:
                     data.pop(field, None)
         new_stock = SemiInboundService.handle_inbound(data)
-        # ★ Fail-Closed: 入库成功响应剥离成本字段
-        resp = new_stock.to_dict()
-        for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'total_price'):
-            resp.pop(k, None)
+        from app.utils.field_permissions import apply_strict_rbac
+        resp = apply_strict_rbac(new_stock.to_dict(), 'StockSemi', user_permissions)
         return jsonify({"code": 200, "msg": "入库成功", "data": resp})
     except Exception as e:
         traceback.print_exc()