feat(ops): partner proxy order list and HQ order delete

Add partner-facing proxy order list/detail; unlock SUPER_ADMIN order delete with cascade cleanup and type filter.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/hq-permission.guard.ts

@@ -7,6 +7,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import {
+  HQ_DANGEROUS_PERMISSION_KEYS,
   HQ_ROLE_DEFAULT_PERMISSIONS,
   expandHqPermissionKeys,
   hasAnySystemSettingsPermission,
@@ -43,8 +44,12 @@ export class HqPermissionsResolver {
     const userKeys = userRows.map((r) => r.permissionKey);
 
     if (account.adminRole === 'SUPER_ADMIN') {
-      // 超管默认拥有业务/管理权限，但不含危险操作；危险权限需按用户显式勾选
-      return expandHqPermissionKeys([...hqBasePermissionKeys(), ...userKeys]);
+      // 超管含危险操作（删用户/订单/城市）；其他角色仍需在权限分配中显式勾选
+      return expandHqPermissionKeys([
+        ...hqBasePermissionKeys(),
+        ...HQ_DANGEROUS_PERMISSION_KEYS,
+        ...userKeys,
+      ]);
     }
 
     const roleRows = await this.prisma.hqRolePermission.findMany({

server/dukang-api/src/common/hq-operation/hq-operation.constants.ts

@@ -22,6 +22,7 @@ export const HqOperationAction = {
   ORDER_SHIP: 'ORDER_SHIP',
   ORDER_STATUS_DEBUG: 'ORDER_STATUS_DEBUG',
   ORDER_BATCH_DELETE: 'ORDER_BATCH_DELETE',
+  ORDER_DELETE: 'ORDER_DELETE',
   ORDER_PROXY_CREATE: 'ORDER_PROXY_CREATE',
   STORE_CREATE: 'STORE_CREATE',
   STORE_UPDATE: 'STORE_UPDATE',
@@ -123,6 +124,7 @@ export const HQ_OPERATION_ACTION_LABELS: Record<string, string> = {
   [HqOperationAction.ORDER_SHIP]: '订单发货',
   [HqOperationAction.ORDER_STATUS_DEBUG]: '订单状态调试',
   [HqOperationAction.ORDER_BATCH_DELETE]: '批量删除订单',
+  [HqOperationAction.ORDER_DELETE]: '删除订单',
   [HqOperationAction.ORDER_PROXY_CREATE]: '总部代下单',
   [HqOperationAction.STORE_CREATE]: '新增门店',
   [HqOperationAction.STORE_UPDATE]: '编辑门店',