chore(frontend): engineering baseline per guide ch.8

- toolchain: vitest+jsdom (15 tests green: permission pure functions
  exhaustive, storage migration), prettier (printWidth 120 to fit the
  dense existing style + 700-line page budget), commitlint conventional
- npm scripts: typecheck / format / test / lint:fix; build fingerprint
  __APP_VERSION__ (version+git hash+build time) shown in Settings > about
- git hooks via core.hooksPath=frontend/.husky: pre-commit lint-staged
  (prettier + eslint --fix best-effort), commit-msg commitlint
- permission pure functions extracted to lib/permissions.ts (single
  source consumed by useAuth/useLogin); AuditLogsPage filters on URL
- backend: resp package unit tests; health version constant aligned
  with frontend package.json

frontend/src/lib/__tests__/permissions.test.ts

@@ -16,7 +16,8 @@ describe('canAccessMenu 纯函数穷举', () => {
   it('每个菜单项的 roles 与判定一致(全角色 × 全菜单)', () => {
     for (const item of menuItems) {
       for (const role of ALL_ROLES) {
-        expect(canAccessMenu(item.id, { role })).toBe(item.roles.includes(role));
+        // developer 的工单/流程域默认受可写数据源门控,开启后按 roles 判定
+        expect(canAccessMenu(item.id, { role, hasWritableDataSourceAccess: true })).toBe(item.roles.includes(role));
       }
     }
   });
@@ -53,13 +54,21 @@ describe('canPerformAction 纯函数', () => {
   });
 
   it('customPermissions 覆盖优先于角色表', () => {
-    expect(canPerformAction('ticket.delete', { role: 'dba', customPermissions: { 'ticket.delete': true } }, ACTION_MAP)).toBe(true);
-    expect(canPerformAction('ticket.execute', { role: 'dba', customPermissions: { 'ticket.execute': false } }, ACTION_MAP)).toBe(false);
+    expect(
+      canPerformAction('ticket.delete', { role: 'dba', customPermissions: { 'ticket.delete': true } }, ACTION_MAP),
+    ).toBe(true);
+    expect(
+      canPerformAction('ticket.execute', { role: 'dba', customPermissions: { 'ticket.execute': false } }, ACTION_MAP),
+    ).toBe(false);
   });
 
   it('developer 的工单创建/审批受可写数据源约束', () => {
-    expect(canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: false }, ACTION_MAP)).toBe(false);
-    expect(canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: true }, ACTION_MAP)).toBe(true);
+    expect(
+      canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: false }, ACTION_MAP),
+    ).toBe(false);
+    expect(
+      canPerformAction('ticket.approve', { role: 'developer', hasWritableDataSourceAccess: true }, ACTION_MAP),
+    ).toBe(true);
   });
 });