feat(后端): 添加授权体系、系统监控与试用期计提

按 2026-11-02 需求补齐计划交付后端能力：
- 角色授权：权限目录化，接口统一准入校验，未登记默认拒绝；
  管理员判断改为按数据库角色重新判定，防止权限码持有者绕过
- 系统监控：单进程采集资源、请求与异常指标，分钟级聚合，
  阈值配置化；敏感配置增加 repr 保护，Redis 密码 URL 转义
- 试用期计提：按回款日判定并写入快照，年度结清与调整单联动；
  人员模型补试用期、离职日期与工资版本历史字段
- 计提模板：公式骨架受控，页面维护名称与参数绑定
- T+ 采集：自动化配置表与进度查询

内置角色禁停用保护对齐模块注释；核算规则版本提为常量并
补充批量核算失败堆栈日志。

影响范围：后端全部模块、数据库迁移 V22-V28
验证：uv run ruff check 通过；922 个单元测试全部通过；
集成测试因本机 MySQL 数据卷被其他容器锁定暂未运行

backend/tests/integration/test_dashboard.py

@@ -3,7 +3,7 @@
 守的口径：
 - 权限：普通用户 403 且文案「无权访问工作台」
 - 总览：绩效合计/人数与台账一致；月份参数非法 400
-- 待办：月结提交后出现待审批；回款未指定批次可命中；同步未建时显式降级
+- 待办：月结提交后出现待审批；回款未指定批次可命中；同步状态取真实记录
 - 风险预警：审批超时命中、参数关闭后不产生条目、阈值参数化生效
 - 最近动态：来源操作日志（写操作可见）
 
@@ -128,7 +128,7 @@ def _activities(client: TestClient, headers: dict, **params) -> dict:
 def test_权限_普通用户403文案(client: TestClient, normal: dict):
     resp = client.get(_DASHBOARD, headers=normal["headers"])
     assert resp.status_code == 403
-    assert resp.json()["message"] == "无权访问工作台"
+    assert resp.json()["message"] == "当前账号没有「首页：查看」权限，请联系管理员授权"
     # 最近动态分页端点同属工作台，权限一致
     resp = client.get(f"{_DASHBOARD}/activities", headers=normal["headers"])
     assert resp.status_code == 403
@@ -182,8 +182,53 @@ def test_待办_待审批与未指定批次与同步降级(client: TestClient, a
     assert any(item["order_type"] == 2 for item in data["todos"]["pending_approvals"])
     assert data["todos"]["unassigned_receipt_total"] >= 1
     assert data["todos"]["unassigned_receipts"][0]["receipt_id"] == ctx["receipt"]["id"]
-    # ⑥ 未建：显式降级
-    assert data["todos"]["sync_available"] is False
+    assert data["todos"]["sync_available"] is True
+    assert data["sync"]["available"] is True
+
+
+def test_首页关闭读取仍展示真实采集成功记录(client: TestClient, admin: dict, monkeypatch):
+    from types import SimpleNamespace
+
+    from sqlalchemy import delete, func, select
+
+    from app.core.db import get_session_factory
+    from app.models import TPlusSyncBatch
+    from app.services import dashboard_service
+
+    monkeypatch.setattr(dashboard_service, "get_settings", lambda: SimpleNamespace(
+        t_plus_enabled=False, t_plus_automation_enabled=False
+    ))
+    prefix = "dashboard-" + uuid.uuid4().hex[:12]
+    finished = datetime(2026, 10, 30, 16, 52, 3)
+    factory = get_session_factory()
+    with factory() as session:
+        baseline = session.scalar(select(func.count()).select_from(TPlusSyncBatch).where(
+            TPlusSyncBatch.sync_mode.in_(("FULL", "INCREMENTAL")),
+            TPlusSyncBatch.status.in_(("FAILED", "PARTIAL")),
+        ))
+        for index, (mode, status) in enumerate([
+            ("FULL", "FAILED"), ("FULL", "SUCCEEDED"), ("AUDIT", "FAILED")
+        ]):
+            session.add(TPlusSyncBatch(
+                batch_no=f"{prefix}-{index}", sync_mode=mode, status=status,
+                source_database="dashboard-test", finished_at=finished,
+            ))
+        session.commit()
+    try:
+        data = _dashboard(client, admin["headers"])
+        assert data["sync"]["latest_status"] == "SUCCEEDED"
+        assert data["sync"]["last_success_at"] is not None
+        assert data["sync"]["enabled"] is False
+        assert data["sync"]["automation_enabled"] is False
+        assert data["todos"]["sync_available"] is True
+        assert data["warnings"]["sync_available"] is True
+        assert data["todos"]["sync_failure_total"] == baseline + 1
+    finally:
+        with factory() as session:
+            session.execute(delete(TPlusSyncBatch).where(
+                TPlusSyncBatch.batch_no.in_([f"{prefix}-{index}" for index in range(3)])
+            ))
+            session.commit()
 
 
 def test_预警_审批超时命中且参数关闭后不产生(client: TestClient, admin: dict):