fix: 取消CEO默认AP台账权限（09-07-manager-ap-access-scope）

server/tests/unit/routes/apOperations.permissions.test.js

@@ -44,7 +44,7 @@ async function buildApp(permissionCodes, enabled = true) {
 describe("AP full-ledger permission boundary", () => {
   it.each([
     ["employee", false], ["manager", false], ["system_admin", false],
-    ["ceo", true], ["finance", true], ["finance_mgr", true], ["admin", true],
+    ["ceo", false], ["finance", true], ["finance_mgr", true], ["admin", true],
   ])("checks both reads for %s", async (role, allowed) => {
     const { app, queries } = await buildApp(resolvePermissionsForRoles([role]));
     try {
@@ -74,7 +74,7 @@ describe("AP full-ledger permission boundary", () => {
     },
   );
 
-  it.each([["finance.ledger.view"], resolvePermissionsForRoles(["manager", "finance"])].map((permissions) => [permissions]))(
+  it.each([["finance.ledger.view"], resolvePermissionsForRoles(["manager", "finance"]), resolvePermissionsForRoles(["ceo", "finance"])].map((permissions) => [permissions]))(
     "honors explicit or combined-role ledger authority %j", async (permissions) => {
       const { app } = await buildApp(permissions);
       try {