feat(server): 完成 P0+P1 后端能力（工作流、RBAC、付款归档）

P0 MVP：

- 认证：login/refresh/logout/forgot/reset + tokenVersion

- RBAC：角色到权限映射 + requirePermission

- 发票池：upload/bind/signed-url + 判重（VALID_003/VALID_005）

- 报销：create/view/submit + 单号生成

- 工作流：approve + department_manager 解析

P1 扩展：

- 动作：reject/return/withdraw（含 comment）

- transfer：任务转审 + 链路上限 3

- pay：approved -> paid + 发票归档 used_complete

- 动态审批链：approval_rules 驱动

回归脚本：

- smoke-test.sh / regression-dedup.sh / regression-workflow-actions.sh

server/src/constants/permissions.js

@@ -0,0 +1,62 @@
+const EMPLOYEE_BASE_PERMISSIONS = [
+  "expense.create",
+  "expense.view_own",
+  "expense.edit_own",
+  "expense.delete_own",
+  "expense.submit",
+  "expense.withdraw",
+  "invoice.upload",
+  "invoice.view_own",
+  "expense.proxy_manage",
+];
+
+const ROLE_PERMISSIONS = {
+  employee: EMPLOYEE_BASE_PERMISSIONS,
+  manager: [...EMPLOYEE_BASE_PERMISSIONS, "expense.approve", "expense.transfer", "expense.view_all"],
+  ceo: [...EMPLOYEE_BASE_PERMISSIONS, "expense.approve", "expense.transfer", "expense.view_all"],
+  finance: [
+    ...EMPLOYEE_BASE_PERMISSIONS,
+    "invoice.manage",
+    "expense.approve",
+    "expense.finance.pay",
+    "expense.view_all",
+  ],
+  finance_mgr: [
+    ...EMPLOYEE_BASE_PERMISSIONS,
+    "invoice.manage",
+    "expense.approve",
+    "expense.finance.pay",
+    "expense.view_all",
+    "expense.finance.override_duplicate",
+    "system.settings",
+  ],
+  administration: ["expense.proxy_submit", "expense.view_own"],
+  hr: ["system.users", "expense.view_all"],
+  admin: ["*"],
+};
+
+function getRolePermissions(roleCode) {
+  return ROLE_PERMISSIONS[roleCode] ?? [];
+}
+
+function resolvePermissionsForRoles(roleCodes) {
+  const permissions = new Set();
+
+  for (const roleCode of roleCodes ?? []) {
+    for (const permission of getRolePermissions(roleCode)) {
+      permissions.add(permission);
+    }
+  }
+
+  return Array.from(permissions);
+}
+
+function hasPermission(permissionCodes, permission) {
+  return permissionCodes.includes("*") || permissionCodes.includes(permission);
+}
+
+module.exports = {
+  ROLE_PERMISSIONS,
+  resolvePermissionsForRoles,
+  hasPermission,
+};