feat(finance): 完成财务控制、L1 钱包硬化与迁移收敛

- P0/P1：影子总账追加调整、关账/退款/资金/积分幂等、成本版本追溯、对账订单项维度
- 迁移收敛：原 103–114 合并为 103_finance_foundation、104_finance_controls、105_work_order_consignment
- 数据：L1 钱包 BIGINT/CHECK/奖励幂等；重复奖励审计口径修正与人工核对清单
- 报表：销售毛利缺失成本收入提示，旧收支页明确现金流口径
- 文档：同步迁移基线、合并评估、代码复核与上线说明

apps/backend/src/routes/admin/finance-ledger.ts

@@ -22,6 +22,7 @@ import {
   resolveFinanceReconciliation,
 } from '../../services/finance/finance-reconciliation-service.js'
 import type { JsonObject } from '../../types/json.js'
+import { formatShanghaiDate } from '../../utils/finance-date-range.js'
 import { bodyOf, idOf, sessionOf } from './request-helpers.js'
 import { createJsonHandler, requireAdminPermission, requireAdminRoles } from './session.js'
 
@@ -45,7 +46,7 @@ router.get(
   createJsonHandler(
     (req) => {
       const query = req.query as Record<string, unknown>
-      const today = new Date().toISOString().slice(0, 10)
+      const today = formatShanghaiDate(new Date())
       return getTrialBalance({
         dateFrom: String(query.dateFrom || query.date_from || `${today.slice(0, 7)}-01`),
         dateTo: String(query.dateTo || query.date_to || today),
@@ -71,11 +72,11 @@ router.get(
 
 router.post(
   '/finance/ledger/sync',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler(
     (req) => {
       const body = bodyOf(req)
-      const today = new Date().toISOString().slice(0, 10)
+      const today = formatShanghaiDate(new Date())
       return syncFinanceLedgerFromFacts({
         dateFrom: String(body.dateFrom || body.date_from || `${today.slice(0, 7)}-01`),
         dateTo: String(body.dateTo || body.date_to || today),
@@ -97,7 +98,7 @@ router.post(
 
 router.post(
   '/finance/ledger/manual-voucher',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler((req) => postManualVoucher(bodyOf(req) as never, sessionOf(req)), {
     successMessage: '凭证已创建',
     errorMessage: '创建凭证失败',
@@ -123,13 +124,16 @@ router.get(
 
 router.post(
   '/finance/periods/:periodKey/close',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.close'),
   createJsonHandler(
-    (req) =>
-      closeFinancePeriod(
+    (req) => {
+      const body = bodyOf(req)
+      return closeFinancePeriod(
         String((req.params as Record<string, string>).periodKey || ''),
         sessionOf(req),
-      ),
+        String(body.reason || ''),
+      )
+    },
     {
       successMessage: '期间已关账',
       errorMessage: '关账失败',
@@ -146,7 +150,7 @@ router.post(
 
 router.post(
   '/finance/periods/:periodKey/reopen',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.close'),
   createJsonHandler(
     (req) => reopenFinancePeriod(String((req.params as Record<string, string>).periodKey || '')),
     {
@@ -175,7 +179,7 @@ router.get(
 
 router.post(
   '/finance/reconciliations/import',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.reconcile'),
   createJsonHandler((req) => importFinanceReconciliation(bodyOf(req), sessionOf(req)), {
     successMessage: '账单已导入',
     errorMessage: '导入账单失败',
@@ -201,7 +205,7 @@ router.get(
 
 router.post(
   '/finance/reconciliations/:id/resolve',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.reconcile'),
   createJsonHandler(
     (req) => {
       const body = bodyOf(req)

apps/backend/src/routes/admin/finance.ts

@@ -68,7 +68,7 @@ router.get(
 router.post(
   '/finance/sales-facts/rebuild',
   requireAdminRoles(['admin', 'operator', 'finance']),
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler(
     (req) =>
       rebuildSalesDailyFacts(
@@ -106,7 +106,7 @@ router.post(
 
 router.get(
   '/finance/manual-fulfillment/pending',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminRoles(['admin', 'operator', 'support', 'finance']),
   createJsonHandler(
     (req) => listManualFulfillmentPending(req.query as Record<string, unknown>, sessionOf(req)),
     {
@@ -119,7 +119,7 @@ router.get(
 
 router.post(
   '/finance/manual-fulfillment/confirm',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminRoles(['admin', 'operator', 'support', 'finance']),
   createJsonHandler((req) => confirmManualFulfillment(bodyOf(req), sessionOf(req)), {
     successMessage: '履约已确认',
     errorMessage: '确认履约失败',

apps/backend/src/routes/admin/kuaishou-industry.ts

@@ -30,7 +30,7 @@ const router = Router()
 
 router.post(
   '/kuaishou-industry/orders/:orderId/refunds/approve-and-record',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler(
     (req) => {
       const body = req.body as Record<string, unknown>

apps/backend/src/routes/admin/orders.ts

@@ -16,7 +16,7 @@ import type { AdminOrderRouteParams, AdminOrderRouteQuery } from '../../types/ad
 
 const router = Router()
 
-router.use('/orders', requireAdminRoles(['admin', 'operator', 'support']))
+router.use('/orders', requireAdminRoles(['admin', 'operator', 'support', 'finance']))
 
 router.get(
   '/orders',
@@ -105,7 +105,7 @@ router.get(
 
 router.post(
   '/orders/:orderId/refunds',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler(
     (req) =>
       createManualRefund(
@@ -135,7 +135,7 @@ router.post(
 
 router.post(
   '/orders/:orderId/refunds/:refundId/void',
-  requireAdminPermission('finance.config'),
+  requireAdminPermission('finance.post'),
   createJsonHandler(
     (req) =>
       voidOrderRefund(