fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

.trellis/tasks/09-07-manager-ap-access-scope/task.json

@@ -0,0 +1,39 @@
+{
+  "id": "manager-ap-access-scope",
+  "name": "manager-ap-access-scope",
+  "title": "经理 AP 财务台账与付款汇总访问收紧",
+  "description": "使用 finance.ledger.view 收紧 AP 全量读取，保留 CEO 财务读取与经理复核；其他 view_all 和导出授权不变，不部署",
+  "status": "in_progress",
+  "dev_type": null,
+  "scope": "AP-only 专用读取权限、对应前后端投影和权限验证",
+  "package": null,
+  "priority": "P2",
+  "creator": "shunli",
+  "assignee": "shunli",
+  "createdAt": "2026-09-07",
+  "completedAt": null,
+  "branch": "main",
+  "base_branch": "main",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [
+    "server/src/constants/permissions.js",
+    "server/src/routes/apOperations.js",
+    "server/src/services/workspaceSettings.js",
+    "client/src/auth/permissions.ts",
+    "client/src/router/index.tsx",
+    "client/src/components/navigation/NavLinks.tsx",
+    "client/tests/e2e/payment-reviewer-permissions.spec.ts",
+    "server/tests/unit/routes/apOperations.permissions.test.js",
+    "server/tests/unit/constants/permissions.test.js",
+    "server/tests/unit/workspaceSettings.navigation.test.js",
+    "server/tests/unit/routes/exports.apOperations.test.js",
+    ".trellis/spec/hyb-oa/security-privacy.md"
+  ],
+  "notes": "",
+  "meta": {}
+}