fix(borrow,outbound): 普通用户记录只看本人——按领用人/借用人姓名(不含账号前缀)匹配

- 出库记录/借还记录：非管理者视角时按 领用人(consumer_name)/借用人(borrower_name) 过滤
- 匹配取登录名 username.split(/)[0] 的姓名；兼容库里存“姓名/xiaolongxia”全名(姓名+/前缀)
- 修复：管理员替员工创建、领用人=员工 的单，员工登录可见

inventory-backend/app/api/v1/transactions.py

@@ -163,7 +163,20 @@ def get_records():
     keyword = request.args.get('keyword', '')
     search_type = request.args.get('search_type', 'all')
 
-    res = TransService.get_records(page=page, limit=10, status=status, keyword=keyword, search_type=search_type)
+    # ★ 数据权限：普通用户只看“借用人=本人姓名(不含账号前缀)”的借还记录；管理者看全部
+    borrower_name = None
+    if not is_privileged_viewer():
+        _identity = get_jwt_identity()
+        if _identity:
+            from app.models.system import SysUser
+            _u = SysUser.query.get(int(_identity))
+            _uname = _u.username if _u else ''
+            borrower_name = _uname.split('/')[0].strip() if _uname else None
+
+    res = TransService.get_records(
+        page=page, limit=10, status=status, keyword=keyword,
+        search_type=search_type, borrower_name=borrower_name
+    )
 
     # ★ service 层异常时：code==500 的字典（带 traceback），需要直通到前端，便于排查
     if isinstance(res, dict) and res.get('code') == 500: