fix: 补全审计/出库审批/采购管理/借库审批的权限保护+公司隔离

- audit.py: 补@permission_required(system_audit)+import, 审计日志通过split_part关联用户表过滤公司
- outbound.py: 出库审批5个端点全补@permission_required(outbound_list)
- purchase.py: 采购管理7个端点全补@permission_required(inbound_buy)
- borrow_service: 借库审批列表通过applicant_id关联用户表过滤公司
- outbound_service: 出库审批列表通过applicant_id关联用户表过滤公司
- purchase_service: 采购列表通过base_id+requester_id双路过滤公司
- base_service/search_material: 去除debug日志
- decorators: 去除debug日志

inventory-backend/app/api/v1/audit.py

@@ -1,6 +1,7 @@
 # inventory-backend/app/api/v1/audit.py
 from flask import Blueprint, request, jsonify, current_app
 from flask_jwt_extended import jwt_required, get_jwt
+from app.utils.decorators import permission_required
 from app.models.audit import AuditLog
 from app.extensions import db
 from sqlalchemy import or_
@@ -12,6 +13,7 @@ audit_bp = Blueprint('audit', __name__)
 
 @audit_bp.route('/logs', methods=['GET'])
 @jwt_required()
+@permission_required('system_audit')
 def get_audit_logs():
     """获取审计日志列表（分页）"""
     try:
@@ -54,6 +56,15 @@ def get_audit_logs():
             except ValueError:
                 pass
 
+        # 【行级数据隔离】通过操作人 username 关联用户表过滤公司
+        from app.utils.decorators import get_current_company_filter
+        from app.models.system import SysUser
+        from sqlalchemy import func
+        company_limit = get_current_company_filter()
+        if company_limit is not None:
+            query = query.join(SysUser, func.split_part(SysUser.username, '/', 2) == AuditLog.username) \
+                         .filter(SysUser.department == company_limit)
+
         # 排序
         query = query.order_by(AuditLog.created_at.desc())
 
@@ -64,12 +75,16 @@ def get_audit_logs():
         # 序列化
         data = [log.to_dict() for log in logs]
 
-        # 获取可用的模块和操作类型（用于下拉选项）
-        modules = db.session.query(AuditLog.module).distinct().all()
-        modules = [m[0] for m in modules if m[0]]
-        
-        actions = db.session.query(AuditLog.action).distinct().all()
-        actions = [a[0] for a in actions if a[0]]
+        # 获取可用的模块和操作类型（同公司范围内）
+        modules_query = db.session.query(AuditLog.module).distinct()
+        actions_query = db.session.query(AuditLog.action).distinct()
+        if company_limit is not None:
+            modules_query = modules_query.join(SysUser, func.split_part(SysUser.username, '/', 2) == AuditLog.username) \
+                                         .filter(SysUser.department == company_limit)
+            actions_query = actions_query.join(SysUser, func.split_part(SysUser.username, '/', 2) == AuditLog.username) \
+                                         .filter(SysUser.department == company_limit)
+        modules = [m[0] for m in modules_query.all() if m[0]]
+        actions = [a[0] for a in actions_query.all() if a[0]]
 
         return jsonify({
             'code': 200,