feat(后端): 添加授权体系、系统监控与试用期计提

按 2026-11-02 需求补齐计划交付后端能力：
- 角色授权：权限目录化，接口统一准入校验，未登记默认拒绝；
  管理员判断改为按数据库角色重新判定，防止权限码持有者绕过
- 系统监控：单进程采集资源、请求与异常指标，分钟级聚合，
  阈值配置化；敏感配置增加 repr 保护，Redis 密码 URL 转义
- 试用期计提：按回款日判定并写入快照，年度结清与调整单联动；
  人员模型补试用期、离职日期与工资版本历史字段
- 计提模板：公式骨架受控，页面维护名称与参数绑定
- T+ 采集：自动化配置表与进度查询

内置角色禁停用保护对齐模块注释；核算规则版本提为常量并
补充批量核算失败堆栈日志。

影响范围：后端全部模块、数据库迁移 V22-V28
验证：uv run ruff check 通过；922 个单元测试全部通过；
集成测试因本机 MySQL 数据卷被其他容器锁定暂未运行

backend/tests/integration/test_param_management.py

@@ -13,6 +13,7 @@
 
 import uuid
 from datetime import date, timedelta
+from decimal import Decimal
 from fractions import Fraction
 
 import pytest
@@ -86,13 +87,14 @@ def _snapshot_value(client: TestClient, admin: dict, param_code: str, *, as_of:
 class TestCatalog:
     """参数目录：种子完整性与时点化回溯。"""
 
-    def test_目录共22项且覆盖九个分组(self, client: TestClient, admin: dict) -> None:
+    def test_目录含27项及产品系数组(self, client: TestClient, admin: dict) -> None:
         """V10 起含工作台预警规则三项（16 计提项 + 3 BOOL 开关 + 3 预警项）。"""
         items = client.get(_PARAMS, headers=admin["headers"]).json()["data"]
-        assert len(items) == 22
+        assert len(items) == 27
         groups = {item["param_group"] for item in items}
         assert groups == {
             "业务员个人户",
+            "产品系数表",
             "经理分成",
             "企业户",
             "信息员",
@@ -358,7 +360,7 @@ class TestPreview:
             "probation.annual.threshold",
         ]
 
-    def test_经理聚合口径_预览拒绝(self, client: TestClient, admin: dict) -> None:
+    def test_经理个人业务_试算排除且指向月结(self, client: TestClient, admin: dict) -> None:
         payload = {
             "business_role": "sales_manager",
             "customer_type": "personal",
@@ -370,14 +372,13 @@ class TestPreview:
             "received_amount": "0",
         }
         resp = client.post(f"{_PARAMS}/preview", json=payload, headers=admin["headers"])
-        assert resp.status_code == 400
-        # 守两件事：① 聚合口径不允许单笔试算（拒绝而不是算出个错数）；
-        # ② 提示要能指导下一步（点名是谁的口径 + 去哪儿看），不是一句「不支持」。
-        message = resp.json()["message"]
-        assert "营销经理" in message
-        assert "月度结算" in message
+        assert resp.status_code == 200
+        data = resp.json()["data"]
+        assert data["rate"] == "0"
+        assert Decimal(data["performance_amount"]) == 0
+        assert "团队分成" in data["rate_text"]
 
-    def test_回款日早于发货日_400(self, client: TestClient, admin: dict) -> None:
+    def test_预收先款后货_按最高比例预览(self, client: TestClient, admin: dict) -> None:
         payload = {
             "business_role": "salesperson",
             "customer_type": "personal",
@@ -388,10 +389,10 @@ class TestPreview:
             "profit": "45000",
             "received_amount": "0",
         }
-        assert (
-            client.post(f"{_PARAMS}/preview", json=payload, headers=admin["headers"]).status_code
-            == 400
-        )
+        response = client.post(f"{_PARAMS}/preview", json=payload, headers=admin["headers"])
+        assert response.status_code == 200
+        assert response.json()["data"]["rate"] == "1/100"
+        assert response.json()["data"]["payment_days"] == -8
 
     def test_企业户_千分比换算后金额精确(self, client: TestClient, admin: dict) -> None:
         """企业户分支：enterprise.rate 存储 "3"（3‰），须换算为 3/1000 再相乘。
@@ -476,12 +477,25 @@ class TestPreview:
 class TestPermission:
     """权限分层（澄清 #17 答复 2026-10-19）：查看可（登录即可）、修改仅管理员。"""
 
-    def test_普通用户查看目录_200(self, client: TestClient, make_user, auth_headers) -> None:
+    def test_普通用户目录须角色授权后可读(self, client: TestClient, make_user, auth_headers) -> None:
         user = make_user([ROLE_USER])
         headers = auth_headers(user)
         resp = client.get(_PARAMS, headers=headers)
+        assert resp.status_code == 403
+        from sqlalchemy import select
+
+        from app.models import Permission, Role, RolePermission, UserRole
+        with get_session_factory()() as session:
+            permission = session.scalar(select(Permission).where(Permission.perm_code == "system:params:view"))
+            role = Role(role_code="t_param_view_" + uuid.uuid4().hex[:8], role_name="参数查看测试角色", status=1)
+            session.add(role)
+            session.flush()
+            session.add(RolePermission(role_id=role.id, permission_id=permission.id))
+            session.add(UserRole(user_id=user["id"], role_id=role.id))
+            session.commit()
+        resp = client.get(_PARAMS, headers=headers)
         assert resp.status_code == 200
-        assert len(resp.json()["data"]) == 22
+        assert len(resp.json()["data"]) == 27
 
     def test_未登录访问目录_403(self, client: TestClient) -> None:
         # LoginUser 依赖无令牌即拒（401 语义归登录态失效，此处由依赖抛 403/401