feat: 完成P6-P8前端能力闭环（V3,D2,D3,B3）

client/src/auth/permissions.ts

@@ -17,16 +17,24 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "expense.approve",
     "expense.transfer",
     "expense.view_all",
+    "report.dashboard.view",
+    "budget.view",
+    "budget.manage",
   ],
   ceo: [
     ...EMPLOYEE_BASE_PERMISSIONS,
     "expense.approve",
     "expense.transfer",
     "expense.view_all",
+    "report.dashboard.view",
+    "budget.view",
   ],
   finance: [
     ...EMPLOYEE_BASE_PERMISSIONS,
     "invoice.manage",
+    "invoice.verify",
+    "report.dashboard.view",
+    "budget.view",
     "expense.approve",
     "expense.finance.pay",
     "expense.view_all",
@@ -34,6 +42,12 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
   finance_mgr: [
     ...EMPLOYEE_BASE_PERMISSIONS,
     "invoice.manage",
+    "invoice.verify",
+    "report.dashboard.view",
+    "budget.view",
+    "budget.manage",
+    "integration.manage",
+    "notification.channel.manage",
     "expense.approve",
     "expense.finance.pay",
     "expense.view_all",
@@ -41,8 +55,18 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "system.settings",
     "system.audit.view",
   ],
-  administration: ["expense.proxy_submit", "expense.view_own"],
-  hr: ["system.users", "expense.view_all"],
+  administration: [
+    "expense.proxy_submit",
+    "expense.create",
+    "expense.view_own",
+    "expense.edit_own",
+    "expense.delete_own",
+    "expense.submit",
+    "expense.withdraw",
+    "invoice.upload",
+    "invoice.view_own",
+  ],
+  hr: ["system.users", "system.users_sensitive", "expense.view_all", "report.dashboard.view"],
   admin: ["*"],
 };