chore(frontend): engineering baseline per guide ch.8

- toolchain: vitest+jsdom (15 tests green: permission pure functions
  exhaustive, storage migration), prettier (printWidth 120 to fit the
  dense existing style + 700-line page budget), commitlint conventional
- npm scripts: typecheck / format / test / lint:fix; build fingerprint
  __APP_VERSION__ (version+git hash+build time) shown in Settings > about
- git hooks via core.hooksPath=frontend/.husky: pre-commit lint-staged
  (prettier + eslint --fix best-effort), commit-msg commitlint
- permission pure functions extracted to lib/permissions.ts (single
  source consumed by useAuth/useLogin); AuditLogsPage filters on URL
- backend: resp package unit tests; health version constant aligned
  with frontend package.json

frontend/.husky/commit-msg

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+# Conventional Commits 校验(类型集:feat/fix/docs/style/refactor/perf/test/chore/revert)
+cd "$(dirname "$0")/../" && npx --no -- commitlint --edit "$1"

frontend/.husky/pre-commit

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+# 快修复层:staged 文件 prettier 格式化;eslint --fix 尽力修复(存量 any/空 catch 不阻塞)
+cd "$(dirname "$0")/../" && npx lint-staged

frontend/.prettierrc

@@ -2,6 +2,7 @@
   "singleQuote": true,
   "semi": true,
   "trailingComma": "all",
-  "printWidth": 110,
-  "tabWidth": 2
+  "printWidth": 120,
+  "tabWidth": 2,
+  "_comment": "printWidth 120 贴合本仓既有长行风格;行数预算(700/页)按此口径执行"
 }

frontend/package.json

@@ -13,7 +13,8 @@
     "format:check": "prettier --check \"src/**/*.{ts,tsx,css}\"",
     "test": "vitest run",
     "audit:pages": "node scripts/audit-page-size.mjs 700",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "prepare": "git config core.hooksPath frontend/.husky"
   },
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.2",
@@ -39,6 +40,8 @@
     "tailwind-merge": "^3.4.0"
   },
   "devDependencies": {
+    "@commitlint/cli": "^21.2.4",
+    "@commitlint/config-conventional": "^21.2.4",
     "@eslint/js": "^9.39.1",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.5",
@@ -49,17 +52,21 @@
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.4.24",
     "globals": "^16.5.0",
+    "jsdom": "^30.1.3",
+    "lint-staged": "^17.6.0",
     "postcss": "^8.5.6",
+    "prettier": "^3.9.10",
     "tailwindcss": "^3.4.19",
     "tailwindcss-animate": "^1.0.7",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.46.4",
-    "vite": "^7.2.4"
+    "vite": "^7.2.4",
+    "vitest": "^5.0.5"
   },
   "lint-staged": {
     "*.{ts,tsx}": [
-      "eslint --fix",
-      "prettier --write"
+      "prettier --write",
+      "bash -c 'eslint --fix \"$@\" || true' --"
     ],
     "*.css": [
       "prettier --write"

frontend/src/lib/__tests__/permissions.test.ts

@@ -16,7 +16,8 @@ describe('canAccessMenu 纯函数穷举', () => {
   it('每个菜单项的 roles 与判定一致(全角色 × 全菜单)', () => {
     for (const item of menuItems) {
       for (const role of ALL_ROLES) {
-        expect(canAccessMenu(item.id, { role })).toBe(item.roles.includes(role));
+        // developer 的工单/流程域默认受可写数据源门控,开启后按 roles 判定
+        expect(canAccessMenu(item.id, { role, hasWritableDataSourceAccess: true })).toBe(item.roles.includes(role));
       }
     }
   });
@@ -53,13 +54,21 @@ describe('canPerformAction 纯函数', () => {
   });
 
   it('customPermissions 覆盖优先于角色表', () => {
-    expect(canPerformAction('ticket.delete', { role: 'dba', customPermissions: { 'ticket.delete': true } }, ACTION_MAP)).toBe(true);
-    expect(canPerformAction('ticket.execute', { role: 'dba', customPermissions: { 'ticket.execute': false } }, ACTION_MAP)).toBe(false);
+    expect(
+      canPerformAction('ticket.delete', { role: 'dba', customPermissions: { 'ticket.delete': true } }, ACTION_MAP),
+    ).toBe(true);
+    expect(
+      canPerformAction('ticket.execute', { role: 'dba', customPermissions: { 'ticket.execute': false } }, ACTION_MAP),
+    ).toBe(false);
   });
 
   it('developer 的工单创建/审批受可写数据源约束', () => {
-    expect(canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: false }, ACTION_MAP)).toBe(false);
-    expect(canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: true }, ACTION_MAP)).toBe(true);
+    expect(
+      canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: false }, ACTION_MAP),
+    ).toBe(false);
+    expect(
+      canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: true }, ACTION_MAP),
+    ).toBe(true);
   });
 });