feat(P11-P12): 落地治理开关与移动端MVP（G0-G6/H1/M1-M4）

- 新增 Feature Flag 模型、评估服务与管理 API（erp_sync/invoice_verification）\n- 完成 ERP 与验真灰度收口（路由/服务/作业统一判定）\n- 补齐 pay 与手动 sync 的 department_id 灰度上下文\n- 增加管理后台开关页、PWA 基础设施与移动拍照/审批页面\n- 增加回归脚本、安全基线与压测脚本，更新文档与执行合同\n\nIssue: G0,G1,G2,G3,G4,G5,G6,H1,M1,M2,M3,M4

client/src/router/index.tsx

@@ -3,12 +3,15 @@ import { AppShellLayout } from "../layouts/AppShellLayout";
 import { AuthLayout } from "../layouts/AuthLayout";
 import { AuditLogsPage } from "../pages/AuditLogsPage";
 import { ApprovalRulesPage } from "../pages/ApprovalRulesPage";
+import { FeatureFlagsPage } from "../pages/FeatureFlagsPage";
 import { ChangePasswordPage } from "../pages/ChangePasswordPage";
 import { BudgetsPage } from "../pages/BudgetsPage";
 import { DashboardPage } from "../pages/DashboardPage";
 import { DepartmentsPage } from "../pages/DepartmentsPage";
 import { DelegationsPage } from "../pages/DelegationsPage";
 import { ForbiddenPage } from "../pages/ForbiddenPage";
+import { MobileApprovalsPage } from "../pages/MobileApprovalsPage";
+import { MobileCapturePage } from "../pages/MobileCapturePage";
 import { InvoicePoolPage } from "../pages/InvoicePoolPage";
 import { LoginPage } from "../pages/LoginPage";
 import { NotificationsPage } from "../pages/NotificationsPage";
@@ -111,6 +114,24 @@ export function AppRouter() {
           }
         />
 
+        <Route
+          path="mobile/capture"
+          element={
+            <RequirePermission anyOf={["invoice.upload", "invoice.manage"]}>
+              <MobileCapturePage />
+            </RequirePermission>
+          }
+        />
+
+        <Route
+          path="mobile/approvals"
+          element={
+            <RequirePermission anyOf={["expense.approve"]}>
+              <MobileApprovalsPage />
+            </RequirePermission>
+          }
+        />
+
         <Route path="notifications" element={<NotificationsPage />} />
 
         <Route
@@ -158,6 +179,15 @@ export function AppRouter() {
           }
         />
 
+        <Route
+          path="system/feature-flags"
+          element={
+            <RequirePermission anyOf={["system.settings"]}>
+              <FeatureFlagsPage />
+            </RequirePermission>
+          }
+        />
+
         <Route path="settings/profile" element={<ProfilePage />} />
       </Route>