fix(权限): 修复业务接入预览权限映射

业务接入预览属于只读预演，不应要求执行导入权限。\n将预览接口映射到 tplus:preview，并增加路由权限回归，避免只读角色被错误拒绝。\n\n影响范围：T+ 工作台业务接入预览接口与权限策略。\n\nCo-Authored-By: Claude Code <noreply@anthropic.com>

backend/app/services/authorization_policy.py

@@ -58,6 +58,8 @@ def permission_for(module, name, method, *, params=None, body=None):
     if module == "system.tplus":
         return "tplus:" + ("view" if method == "GET" else "retry" if name == "retry" else "collect")
     if module == "system.tplus_workbench":
+        if name == "business_sync_preview":
+            return "tplus:preview"
         if name.startswith("business_sync_"):
             return "tplus:view" if method == "GET" else "tplus:import"
         if name == "work_report":

backend/tests/unit/test_authorization_policy.py

@@ -30,5 +30,14 @@ def test_全部受保护接口都有权限映射():
     assert not missing, missing
 
 
+def test_业务接入预览只需要预览权限():
+    assert permission_for(
+        'system.tplus_workbench',
+        'business_sync_preview',
+        'POST',
+        body={},
+    ) == 'tplus:preview'
+
+
 def test_未知接口没有默认放行():
     assert permission_for('future_module','new_action','GET') is None