feat(api): 计提参数查看放开登录用户、修改仅管理员（#17/#6 答复）

- deps 新增 LoginUser 依赖；params 只读七端点改登录即可，写（提交/撤回）保持 AdminUser
- 前端 params 路由 requiresAdmin → allowedRoles（admin/finance/leader）；页面写按钮按角色显隐
- 权限用例分层：普通用户目录 200、提交/撤回 403、未登录拦截

Co-Authored-By: Claude Code <noreply@anthropic.com>

backend/tests/integration/test_param_management.py

@@ -437,12 +437,23 @@ class TestPreview:
 
 
 class TestPermission:
-    """权限：普通用户全部 403。"""
+    """权限分层（澄清 #17 答复 2026-10-19）：查看可（登录即可）、修改仅管理员。"""
 
-    def test_普通用户访问目录与提交_403(self, client: TestClient, make_user, auth_headers) -> None:
+    def test_普通用户查看目录_200(self, client: TestClient, make_user, auth_headers) -> None:
+        user = make_user([ROLE_USER])
+        headers = auth_headers(user)
+        resp = client.get(_PARAMS, headers=headers)
+        assert resp.status_code == 200
+        assert len(resp.json()["data"]) == 19
+
+    def test_未登录访问目录_403(self, client: TestClient) -> None:
+        # LoginUser 依赖无令牌即拒（401 语义归登录态失效，此处由依赖抛 403/401
+        # 均属拦截；显式断言不泄露数据即可）
+        assert client.get(_PARAMS).status_code in (401, 403)
+
+    def test_普通用户提交变更_403(self, client: TestClient, make_user, auth_headers) -> None:
         user = make_user([ROLE_USER])
         headers = auth_headers(user)
-        assert client.get(_PARAMS, headers=headers).status_code == 403
         resp = client.post(
             f"{_PARAMS}/changes",
             json={
@@ -452,3 +463,8 @@ class TestPermission:
             headers=headers,
         )
         assert resp.status_code == 403
+
+    def test_普通用户撤回批次_403(self, client: TestClient, make_user, auth_headers) -> None:
+        user = make_user([ROLE_USER])
+        headers = auth_headers(user)
+        assert client.delete(f"{_PARAMS}/changes/1", headers=headers).status_code == 403