feat(client): 初始化前端壳与鉴权守卫（P1-5）

- 技术栈：React 18 + TypeScript + Vite + Tailwind

- API 层：ApiError + 401 自动刷新 + single-flight 重试

- 鉴权：内存 Access Token + Cookie Refresh + 启动 bootstrap

- RBAC：权限映射 + RequireAuth/RequirePermission 路由守卫

- 布局：OA 工作台壳层 + 侧边栏 + 5 个占位页面

- 样式：复用 hyb-web 视觉 token（单向同步）

- 文档：新增 client README，补充 server 联调说明

client/src/pages/ProfilePage.tsx

@@ -0,0 +1,56 @@
+import { PageHeader } from "../components/common/PageHeader";
+import { useAuth } from "../auth/AuthContext";
+
+export function ProfilePage() {
+  const { me, permissions } = useAuth();
+
+  return (
+    <div>
+      <PageHeader title="个人设置" subtitle="展示当前登录人的基础信息与权限摘要。" />
+
+      <section className="card-std">
+        <h3 className="card-title">个人信息</h3>
+        <dl className="grid gap-3 text-sm text-slate-700 md:grid-cols-2">
+          <div>
+            <dt className="text-secondary">姓名</dt>
+            <dd className="font-medium text-slate-900">{me?.name ?? "-"}</dd>
+          </div>
+          <div>
+            <dt className="text-secondary">员工号</dt>
+            <dd className="font-medium text-slate-900">{me?.employeeNo ?? "-"}</dd>
+          </div>
+          <div>
+            <dt className="text-secondary">邮箱</dt>
+            <dd className="font-medium text-slate-900">{me?.email ?? "-"}</dd>
+          </div>
+          <div>
+            <dt className="text-secondary">手机号</dt>
+            <dd className="font-medium text-slate-900">{me?.phone ?? "-"}</dd>
+          </div>
+          <div>
+            <dt className="text-secondary">部门ID</dt>
+            <dd className="font-medium text-slate-900">{me?.departmentId ?? "-"}</dd>
+          </div>
+          <div>
+            <dt className="text-secondary">直属上级ID</dt>
+            <dd className="font-medium text-slate-900">{me?.directManagerId ?? "-"}</dd>
+          </div>
+        </dl>
+      </section>
+
+      <section className="card-std mt-4">
+        <h3 className="card-title">权限列表</h3>
+        <div className="flex flex-wrap gap-2">
+          {permissions.map((permission) => (
+            <span
+              className="rounded-full bg-primary-50 px-2.5 py-1 text-xs font-medium text-primary"
+              key={permission}
+            >
+              {permission}
+            </span>
+          ))}
+        </div>
+      </section>
+    </div>
+  );
+}