feat: 全模块公司隔离 + crossDomain权限码动态跨域控制

- get_current_company_filter: 新增_has_cross_domain_permission, 权限码替代硬编码
- 补全11个Service的get_current_company_filter调用(semi/product/service/outbound/bom/trans/scrap/summary)
- base/search修复: search_material此前无隔离, 已补全
- get_current_company_filter兜底: JWT缺company_name时返回__NO_COMPANY__防止放行
- permission.py: _get_operator_company补全返回值, 修复权限页保存逻辑
- 新增crossDomain迁移脚本, element_type=element挂system_mgmt下

inventory-backend/app/api/v1/inbound/inbound_summary.py

@@ -14,6 +14,7 @@ def get_list():
         start_date = request.args.get('start_date')
         end_date = request.args.get('end_date')
         source_type = request.args.get('source_type') # 可选：筛选 specific table
+        company = request.args.get('company', '')
 
         result = InboundSummaryService.get_list(
             page=page,
@@ -21,7 +22,8 @@ def get_list():
             keyword=keyword,
             start_date=start_date,
             end_date=end_date,
-            source_type=source_type
+            source_type=source_type,
+            company=company
         )
 
         return jsonify({
@@ -47,13 +49,15 @@ def export_data():
         start_date = request.args.get('start_date')
         end_date = request.args.get('end_date')
         source_type = request.args.get('source_type')
+        company = request.args.get('company', '')
 
         # 调用导出服务
         file_stream = InboundSummaryService.export_excel(
             keyword=keyword,
             start_date=start_date,
             end_date=end_date,
-            source_type=source_type
+            source_type=source_type,
+            company=company
         )
 
         from datetime import datetime