fix(partner): skip unauthorized home APIs for sub-accounts

Gate dashboard/stores/orders by permission and move dashboard auth to method level so leaderboard stays open without toasting 403s.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/store/store.controller.ts

@@ -79,18 +79,17 @@ export class PartnerStoreController {
 
 @Controller('partner/dashboard')
 @UseGuards(JwtAuthGuard, PartnerPermissionGuard)
-@RequirePartnerPermissions('store:create', 'store:manage', 'order:view', 'warehouse:manage')
 export class PartnerDashboardController {
   constructor(private readonly storeService: StoreService) {}
 
   @Get()
+  @RequirePartnerPermissions('store:create', 'store:manage', 'order:view', 'warehouse:manage')
   dashboard(@CurrentUser() user: AuthUser) {
     return this.storeService.partnerDashboard(user.actorId);
   }
 
-  @Get('leaderboard')
   /** 任意合伙人子账号可看同主账号排行（激励），不校验业务权限点 */
-  @RequirePartnerPermissions()
+  @Get('leaderboard')
   leaderboard(
     @CurrentUser() user: AuthUser,
     @Query('period') period?: string,