fix: 会计角色访问报表页面提示无权限

- reports API 两个 GET 接口 require_roles 加入 kuaiji
- 新增 migration 为 kuaiji 角色补上报表统计/报表核对的 sys_role_menu 记录

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/reports.py

@@ -30,7 +30,7 @@ def performance_report(
     exclude_ecommerce: bool = Query(default=False),  # 是否排除电商渠道订单
     salesman_id: int | None = Query(default=None),  # 业务员ID筛选
     session: Session = Depends(get_db_session),  # 数据库会话
-    current_user: dict = Depends(require_roles("manager", "admin")),  # 当前登录用户，仅manager和admin
+    current_user: dict = Depends(require_roles("manager", "admin", "kuaiji")),  # 当前登录用户，manager/admin/会计
     _permission_user: dict = Depends(require_permissions("report:performance:view")),  # 权限校验：业绩报表查看权限
 ) -> dict:
     """
@@ -48,7 +48,7 @@ def performance_report(
     返回值：
         业绩统计数据，包含各维度的销售汇总
 
-    权限要求：manager、admin 角色，需 report:performance:view 权限
+    权限要求：manager、admin、kuaiji 角色，需 report:performance:view 权限
     """
     return success_payload(
         report_service.performance_report(
@@ -75,7 +75,7 @@ def report_audit(
     exclude_ecommerce: bool = Query(default=False),
     salesman_id: int | None = Query(default=None),
     session: Session = Depends(get_db_session),
-    current_user: dict = Depends(require_roles("manager", "admin")),
+    current_user: dict = Depends(require_roles("manager", "admin", "kuaiji")),
     _permission_user: dict = Depends(require_permissions("report:performance:view")),
 ) -> dict:
     """报表核对接口，返回基础数据 + 动态异常检测结果。"""

backend/migrations/versions/20260704_0003_grant_kuaiji_reports_menu.py

@@ -0,0 +1,64 @@
+"""为 kuaiji（会计）角色补上报表统计、报表核对页面的菜单权限。
+
+会计角色可以看到菜单但访问时提示无权限，原因是 sys_role_menu 缺少对应记录。
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "20260704_0003"
+down_revision = "20260704_0002"
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+
+    # 找到会计角色 ID
+    role_row = conn.execute(
+        sa.text("SELECT id FROM sys_role WHERE role_code = 'kuaiji' LIMIT 1")
+    ).mappings().first()
+    if role_row is None:
+        return
+    role_id = role_row["id"]
+
+    # 需要授权的菜单路径列表
+    menu_paths = ["/reports/performance", "/reports/audit"]
+
+    for menu_path in menu_paths:
+        menu_row = conn.execute(
+            sa.text("SELECT id FROM sys_menu WHERE menu_path = :mp LIMIT 1"),
+            {"mp": menu_path},
+        ).mappings().first()
+        if menu_row is None:
+            continue
+
+        already = conn.execute(
+            sa.text("SELECT id FROM sys_role_menu WHERE role_id = :rid AND menu_id = :mid"),
+            {"rid": role_id, "mid": menu_row["id"]},
+        ).first()
+        if already is None:
+            conn.execute(
+                sa.text(
+                    "INSERT INTO sys_role_menu (role_id, menu_id, created_at, updated_at) VALUES (:rid, :mid, NOW(), NOW())"
+                ),
+                {"rid": role_id, "mid": menu_row["id"]},
+            )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    role_row = conn.execute(
+        sa.text("SELECT id FROM sys_role WHERE role_code = 'kuaiji' LIMIT 1")
+    ).mappings().first()
+    if role_row is None:
+        return
+    menu_paths = ["/reports/performance", "/reports/audit"]
+    for menu_path in menu_paths:
+        menu_row = conn.execute(
+            sa.text("SELECT id FROM sys_menu WHERE menu_path = :mp LIMIT 1"),
+            {"mp": menu_path},
+        ).mappings().first()
+        if menu_row is not None:
+            conn.execute(
+                sa.text("DELETE FROM sys_role_menu WHERE role_id = :rid AND menu_id = :mid"),
+                {"rid": role_id, "mid": menu_row["id"]},
+            )