fix(consignment): 打通寄卖权限鉴权、指派占库竞态与撤销守卫

- 后台权限白名单补齐 consignment.view/manage/review/fulfill，
  避免在「角色权限」页保存任意角色时静默清除寄卖权限
- 寄卖后台 19 个接口由 requireAdminRoles 改为 requireAdminPermission，
  使 view/manage/review/fulfill 四个权限真正生效
- 指派打手履约改为先原子占库（WHERE status = 'in_stock'），
  失败自动回滚库存，消除并发下同一件现货被两张工单同时认领
- 撤销寄售履约拒绝押金履约模式（worker_deposit），
  避免打手押金不释放造成资金挂账；前端同步隐藏该入口
- 撤销回库不再强制覆盖 allow_matching，保留运营手动关闭的匹配开关
- 新增 4 个回归测试：权限白名单与迁移一致性、占库/回滚条件、撤销守卫

apps/backend/src/routes/admin/worker-platform/consignment.ts

@@ -22,7 +22,7 @@ import {
   fulfillWorkOrderWithConsignment,
   revokeWorkOrderConsignmentFulfillment,
 } from '../../../services/worker-platform/consignment-fulfillment-service.js'
-import { createJsonHandler, requireAdminRoles } from '../session.js'
+import { createJsonHandler, requireAdminPermission } from '../session.js'
 
 const router = Router()
 
@@ -30,7 +30,7 @@ const router = Router()
 
 router.get(
   '/worker-platform/consignment/inventories',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler((req) => fetchAdminConsignmentInventories(req.query), {
     successMessage: 'ok',
     errorMessage: '读取寄卖库存失败',
@@ -40,7 +40,7 @@ router.get(
 
 router.get(
   '/worker-platform/consignment/stats',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler(() => fetchAdminConsignmentStats(), {
     successMessage: 'ok',
     errorMessage: '读取寄卖统计失败',
@@ -50,7 +50,7 @@ router.get(
 
 router.get(
   '/worker-platform/consignment/inventories/:id',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler((req) => getAdminConsignmentInventory(String(req.params.id || '')), {
     successMessage: 'ok',
     errorMessage: '读取寄卖物品详情失败',
@@ -60,7 +60,7 @@ router.get(
 
 router.post(
   '/worker-platform/consignment/inventories',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler(
     (req) => createAdminConsignmentInventory(req.body, req.adminSession?.username || 'admin'),
     {
@@ -73,7 +73,7 @@ router.post(
 
 router.put(
   '/worker-platform/consignment/inventories/:id',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler(
     (req) =>
       updateAdminConsignmentInventory(
@@ -91,7 +91,7 @@ router.put(
 
 router.patch(
   '/worker-platform/consignment/inventories/:id/matching',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler(
     (req) =>
       toggleAdminConsignmentMatching(String(req.params.id || ''), Boolean(req.body?.allowMatching)),
@@ -105,7 +105,7 @@ router.patch(
 
 router.post(
   '/worker-platform/consignment/inventories/:id/archive',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler((req) => archiveAdminConsignmentInventory(String(req.params.id || '')), {
     successMessage: '物品已下架作废',
     errorMessage: '作废寄卖物品失败',
@@ -115,7 +115,7 @@ router.post(
 
 router.post(
   '/worker-platform/consignment/inventories/:id/return',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler(
     (req) =>
       returnAdminConsignmentInventory(
@@ -135,7 +135,7 @@ router.post(
 
 router.get(
   '/worker-platform/consignment/links',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler(() => fetchAdminConsignmentLinks(), {
     successMessage: 'ok',
     errorMessage: '读取收集链接列表失败',
@@ -145,7 +145,7 @@ router.get(
 
 router.post(
   '/worker-platform/consignment/links',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler(
     (req) => createAdminConsignmentLink(req.body, req.adminSession?.username || 'admin'),
     {
@@ -158,7 +158,7 @@ router.post(
 
 router.put(
   '/worker-platform/consignment/links/:id',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.manage'),
   createJsonHandler((req) => updateAdminConsignmentLink(String(req.params.id || ''), req.body), {
     successMessage: '收集链接已更新',
     errorMessage: '更新收集链接失败',
@@ -170,7 +170,7 @@ router.put(
 
 router.get(
   '/worker-platform/consignment/submissions',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler((req) => fetchAdminConsignmentSubmissions(req.query), {
     successMessage: 'ok',
     errorMessage: '读取提报列表失败',
@@ -180,7 +180,7 @@ router.get(
 
 router.get(
   '/worker-platform/consignment/submissions/:id',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler((req) => getAdminConsignmentSubmission(String(req.params.id || '')), {
     successMessage: 'ok',
     errorMessage: '读取提报详情失败',
@@ -190,7 +190,7 @@ router.get(
 
 router.post(
   '/worker-platform/consignment/submissions/:id/approve',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.review'),
   createJsonHandler(
     (req) =>
       approveAdminConsignmentSubmission(
@@ -208,7 +208,7 @@ router.post(
 
 router.post(
   '/worker-platform/consignment/submissions/:id/reject',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.review'),
   createJsonHandler(
     (req) =>
       rejectAdminConsignmentSubmission(
@@ -228,7 +228,7 @@ router.post(
 
 router.get(
   '/worker-platform/consignment/matches/:workOrderId',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.view'),
   createJsonHandler((req) => checkWorkOrderInventoryMatches(String(req.params.workOrderId || '')), {
     successMessage: 'ok',
     errorMessage: '检查寄售库存匹配失败',
@@ -238,7 +238,7 @@ router.get(
 
 router.post(
   '/worker-platform/consignment/fulfill',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.fulfill'),
   createJsonHandler(
     (req) =>
       fulfillWorkOrderWithConsignment({
@@ -256,7 +256,7 @@ router.post(
 
 router.post(
   '/worker-platform/consignment/assign-worker',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.fulfill'),
   createJsonHandler(
     (req) =>
       assignWorkOrderWithConsignmentWorker({
@@ -275,7 +275,7 @@ router.post(
 
 router.post(
   '/worker-platform/consignment/revoke',
-  requireAdminRoles(['admin', 'operator', 'support']),
+  requireAdminPermission('consignment.fulfill'),
   createJsonHandler(
     (req) =>
       revokeWorkOrderConsignmentFulfillment({