fix(backend): 宏观状态权限校验 — 根除 current_user 空值绕过漏洞

Bug: if current_user: 在 Python 中 None/空dict均为falsy，
      一旦 current_user 为空则整个权限块被跳过直接放行。

修复:
1. if not current_user → 直接 raise 401
2. 反转 SUPER_ADMIN 判断: if user_role != 'SUPER_ADMIN' 进入校验
   (避免 if/else/pass 空分支带来的逻辑歧义)
3. main_task is not None 显式判断 (替代隐式 truthy)

backend/app/services/product_service.py

@@ -301,15 +301,18 @@ async def update_overall_status(
     if not product:
         raise HTTPException(status_code=404, detail=f"未找到序列号 {serial_number} 的产品")
 
-    # ── 权限校验 ──
-    if current_user:
+    # ── 权限校验（无 current_user 一律拒绝，杜绝空 dict 绕过）──
+    if not current_user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="请先登录",
+        )
+
     user_role = current_user.get("role", "")
     user_username = current_user.get("username", "")
 
     # SUPER_ADMIN 直接放行
-        if user_role == "SUPER_ADMIN":
-            pass
-        else:
+    if user_role != "SUPER_ADMIN":
         # 检查当前用户是否是该产品主线任务的负责人
         from sqlalchemy import or_
         main_task_result = await db.execute(
@@ -324,7 +327,7 @@ async def update_overall_status(
         )
         main_task = main_task_result.scalar_one_or_none()
         has_permission = (
-                main_task
+            main_task is not None
             and main_task.assignee_id == user_username
         )
         if not has_permission: