fix(partner): grant store staff open/close and media permissions by default

Default new sub-accounts to store:create+store:manage, backfill empty permissions on /partner/me, and treat legacy store staff as allowed to mutate.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/h5-partner/src/lib/staff.ts

@@ -1,9 +1,5 @@
-import {
-  PartnerStaffRole,
-  type CreatePartnerStaffRequest,
-  type PartnerStaffItem,
-  type UpdatePartnerStaffRequest,
-} from '@dukang/shared-types';
+import { PartnerStaffRole, DEFAULT_PARTNER_STORE_STAFF_PERMISSIONS } from '@dukang/shared-types';
+import type { CreatePartnerStaffRequest, PartnerStaffItem, UpdatePartnerStaffRequest } from '@dukang/shared-types';
 import { request } from './api';
 
 export function listPartnerStaff() {
@@ -25,7 +21,10 @@ export function createPartnerStaff(body: CreatePartnerStaffRequest) {
       name: body.name,
       phone: body.phone,
       smsCode: body.smsCode,
-      staffRole: PartnerStaffRole.INTERNAL,
+      staffRole: body.staffRole ?? PartnerStaffRole.INTERNAL,
+      permissions: body.permissions?.length
+        ? body.permissions
+        : [...DEFAULT_PARTNER_STORE_STAFF_PERMISSIONS],
     }),
   });
 }