feat(ops): partner proxy order list and HQ order delete

Add partner-facing proxy order list/detail; unlock SUPER_ADMIN order delete with cascade cleanup and type filter.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/hq-permission.guard.ts

@@ -7,6 +7,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import {
+  HQ_DANGEROUS_PERMISSION_KEYS,
   HQ_ROLE_DEFAULT_PERMISSIONS,
   expandHqPermissionKeys,
   hasAnySystemSettingsPermission,
@@ -43,8 +44,12 @@ export class HqPermissionsResolver {
     const userKeys = userRows.map((r) => r.permissionKey);
 
     if (account.adminRole === 'SUPER_ADMIN') {
-      // 超管默认拥有业务/管理权限，但不含危险操作；危险权限需按用户显式勾选
-      return expandHqPermissionKeys([...hqBasePermissionKeys(), ...userKeys]);
+      // 超管含危险操作（删用户/订单/城市）；其他角色仍需在权限分配中显式勾选
+      return expandHqPermissionKeys([
+        ...hqBasePermissionKeys(),
+        ...HQ_DANGEROUS_PERMISSION_KEYS,
+        ...userKeys,
+      ]);
     }
 
     const roleRows = await this.prisma.hqRolePermission.findMany({