refactor(admin): 路由请求助手去重

finance / fund / cost-center 三个路由文件各自复制了 sessionOf / idOf / bodyOf，
语义相同写法不同。统一到 routes/admin/request-helpers.ts，路由文件只保留业务
差异（fund.ts 的 accountIdOf / expenseIdOf）。

无行为变更：typecheck、lint、773 个测试全部通过。

apps/backend/src/routes/admin/cost-center.ts

@@ -60,7 +60,6 @@ import {
   syncAdminWorkOrderTemplateCostVersions,
 } from '../../services/cost-center/template-bootstrap-service.js'
 import { normalizeManualProducts } from '../../services/cost-center/manual-product-normalization-service.js'
-import type { AdminSession } from '../../services/admin/admin-auth-service.js'
 import {
   syncActualWorkOrderCostSnapshots,
   syncEstimatedOrderItemCostSnapshots,
@@ -72,21 +71,10 @@ import {
   requireAdminRoles,
   requireAnyAdminPermission,
 } from './session.js'
+import { bodyOf, idOf, sessionOf } from './request-helpers.js'
 
 const router = Router()
 
-function sessionOf(req: Request): AdminSession {
-  return req.adminSession as AdminSession
-}
-
-function idOf(req: Request, key: string): number {
-  return Number(req.params[key])
-}
-
-function bodyOf(req: Request): JsonObject {
-  return req.body && typeof req.body === 'object' ? (req.body as JsonObject) : {}
-}
-
 router.use('/cost-center', requireAdminRoles(['admin', 'operator', 'finance', 'support']))
 
 router.get(

apps/backend/src/routes/admin/finance.ts

@@ -1,11 +1,9 @@
-import type { Request } from 'express'
 import { Router } from 'express'
 
 import {
   getAdminFinanceSummary,
   listAdminFinanceTransactions,
 } from '../../services/admin/admin-finance-service.js'
-import type { AdminSession } from '../../services/admin/admin-auth-service.js'
 import {
   getSalesProfitOverview,
   listSalesDailyFacts,
@@ -15,28 +13,16 @@ import {
   confirmManualFulfillment,
   listManualFulfillmentPending,
 } from '../../services/finance/manual-fulfillment-service.js'
-import type { JsonObject } from '../../types/json.js'
 import {
   createJsonHandler,
   requireAdminPermission,
   requireAdminRoles,
   requireAnyAdminPermission,
 } from './session.js'
+import { bodyOf, idOf, sessionOf } from './request-helpers.js'
 
 const router = Router()
 
-function sessionOf(req: Request): AdminSession {
-  return req.adminSession as AdminSession
-}
-
-function idOf(req: Request, key: string) {
-  return Number(req.params[key])
-}
-
-function bodyOf(req: Request): JsonObject {
-  return req.body && typeof req.body === 'object' ? (req.body as JsonObject) : {}
-}
-
 router.get(
   '/finance/summary',
   requireAdminRoles(['admin', 'operator', 'finance']),

apps/backend/src/routes/admin/fund.ts

@@ -27,15 +27,11 @@ import {
   requireAdminRoles,
   requireAnyAdminPermission,
 } from './session.js'
-import type { AdminSession } from '../../services/admin/admin-auth-service.js'
+import { sessionOf } from './request-helpers.js'
 import type { JsonObject } from '../../types/json.js'
 
 const router = Router()
 
-function sessionOf(req: Request): AdminSession {
-  return req.adminSession as AdminSession
-}
-
 function accountIdOf(req: Request): number {
   return Number(req.params.accountId)
 }

apps/backend/src/routes/admin/request-helpers.ts

@@ -0,0 +1,23 @@
+/**
+ * 后台路由的请求取值助手。
+ *
+ * 这些函数只做「从 req 上取已由中间件校验过的值」这一件事，之前在每个路由文件里
+ * 各复制一份，导致同一份语义出现三种写法。统一放这里，路由文件只保留业务差异
+ * （例如 fund.ts 的 accountIdOf / expenseIdOf）。
+ */
+import type { Request } from 'express'
+
+import type { AdminSession } from '../../services/admin/admin-auth-service.js'
+import type { JsonObject } from '../../types/json.js'
+
+export function sessionOf(req: Request): AdminSession {
+  return req.adminSession as AdminSession
+}
+
+export function idOf(req: Request, key: string): number {
+  return Number(req.params[key])
+}
+
+export function bodyOf(req: Request): JsonObject {
+  return req.body && typeof req.body === 'object' ? (req.body as JsonObject) : {}
+}