完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

client/src/auth/permissions.ts

@@ -65,6 +65,7 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "project.manage",
     "budget.view",
     "budget.manage",
+    "payment.batch.review",
   ],
   ceo: [
     ...EMPLOYEE_BASE_PERMISSIONS,
@@ -82,6 +83,7 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "asset.view_all",
     "report.dashboard.view",
     "budget.view",
+    "payment.batch.review",
   ],
   finance: [
     ...EMPLOYEE_BASE_PERMISSIONS,
@@ -97,6 +99,8 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "procurement.view_all",
     "asset.view_all",
     "attendance.view_all",
+    "employee.bank.read",
+    "payroll.manage",
   ],
   finance_mgr: [
     ...EMPLOYEE_BASE_PERMISSIONS,
@@ -127,6 +131,8 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "attendance.view_all",
     "attendance.manage",
     "attendance.sync",
+    "payroll.manage",
+    "employee.bank.read",
   ],
   administration: [
     "expense.proxy_submit",
@@ -152,9 +158,25 @@ const ROLE_PERMISSIONS: Record<string, readonly string[]> = {
     "attendance.sync",
     "system.users",
     "system.users_sensitive",
+    "system.accounts.manage",
+    "system.roles.manage",
+    "employee.bank.manage",
+    "employee.identity.manage",
+    "employee.contract.manage",
     "expense.view_all",
     "report.dashboard.view",
   ],
+  system_admin: [
+    ...EMPLOYEE_BASE_PERMISSIONS,
+    ...PROCUREMENT_SELF_SERVICE_PERMISSIONS,
+    ...ASSET_SELF_SERVICE_PERMISSIONS,
+    "system.accounts.manage",
+    "system.roles.manage",
+    "system.settings",
+    "integration.manage",
+    "notification.channel.manage",
+    "system.audit.view",
+  ],
   admin: ["*"],
 };