perf: 综合安全加固 — RBAC严格映射+异步邮件+字段权限白名单+前端对齐+导入模板

本次提交包含本会话所有修改的最终统一提交

## 权限系统重构
- permission_service.py: 添加入库/采购操作元素 + ensure_default_permissions
- field_permissions.py: 严格1-to-1 Default Deny 字段映射(StockBuy/Semi/Product/MaterialBase)
- decorators.py: _expand_operation_perms 双向粒度桥接 + prevent_double_submit
- deploy_production.sql: 修复 sys_element 别名码(qty_inbound→in_quantity)

## 采购模块
- purchase.py: 权限驱动可见性 + inbound_purchase独立权限 + 价格字段过滤
- purchase_service.py: 异步邮件 + 三阶段批量模糊匹配防N+1
- purchase/index.vue: canApprove严格操作权限 + upload重复修复

## 导出/入
- base_service.py: export_excel 流式写入防OOM + get_latest_specs 优化
- import_service.py + import_api.py: Excel批量导入（模板+预览+执行）
- ImportDialog.vue: 三步骤导入弹窗

## 异步邮件
- email_service.py: send_email_async (守护线程)
- inventory_task.py: send_email→send_email_async

## 前端对齐
- product/semi/buy.vue: 列对齐in_quantity/stock_quantity/available_quantity + localStorage缓存V2
- buyOdoo.vue: 排序修复 + 导入按钮 + 移除点击展开加载
- BomManage.vue: 懒加载分组 + 导入按钮
- list.vue: 导入按钮
- Selection.vue + borrow/apply: BOM匹配修复 + 导入按钮
- outbound/create.vue: 出库类型必选
- AppMain.vue: 移除transition白屏修复
- material_base.ts, outbound.ts, bom.ts, stock.ts: 新增API函数

inventory-backend/app/api/v1/inbound/base.py

@@ -28,7 +28,8 @@ def get_current_user_permissions():
     if not user_role:
         return []
     # 超级管理员返回所有字段权限
-    if user_role.upper() == 'SUPER_ADMIN':
+    from app.utils.constants import UserRole
+    if str(user_role).strip().upper() == UserRole.SUPER_ADMIN:
         return [
             'material_list:*',
             'material_list:id',
@@ -63,33 +64,9 @@ def _invalidate_specs_cache():
 
 
 def filter_item_by_permissions(item_dict, user_permissions):
-    """根据用户权限过滤字段，无权限的字段值置为 None"""
-    if 'material_list:*' in user_permissions:
-        return item_dict
-    field_to_perm = {
-        'id': 'material_list:id',
-        'companyName': 'material_list:companyName',
-        'name': 'material_list:name',
-        'commonName': 'material_list:commonName',
-        'category': 'material_list:category',
-        'type': 'material_list:type',
-        'spec': 'material_list:spec',
-        'unit': 'material_list:unit',
-        'inventoryCount': 'material_list:inventoryCount',
-        'availableCount': 'material_list:availableCount',
-        'generalManual': 'material_list:files',
-        'generalImage': 'material_list:files',
-        'referencePrice': 'material_list:referencePrice',
-        'isEnabled': 'material_list:isEnabled',
-        'isInspectionRequired': 'material_list:isInspectionRequired',
-        'visibilityLevel': 'material_list:visibilityLevel',
-        'manualLinkRemark': 'material_list:manualLinkRemark',
-        'productImageRemark': 'material_list:productImageRemark',
-    }
-    for field, perm_code in field_to_perm.items():
-        if field in item_dict and perm_code not in user_permissions:
-            item_dict[field] = None
-    return item_dict
+    """严格 Default Deny 字段过滤 (see app/utils/field_permissions.py)"""
+    from app.utils.field_permissions import apply_strict_rbac
+    return apply_strict_rbac(item_dict, 'MaterialBase', user_permissions)
 
 
 # ==============================================================================