fix(partner): grant store staff open/close and media permissions by default

Default new sub-accounts to store:create+store:manage, backfill empty permissions on /partner/me, and treat legacy store staff as allowed to mutate.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/store/store.service.ts

@@ -992,7 +992,7 @@ export class StoreService {
     return Array.isArray(account.permissions) ? (account.permissions as string[]) : [];
   }
 
-  /** 主账号，或具备 store:manage / store:create 的子账号可改门店 */
+  /** 主账号，或门店类子账号（含历史空权限）可改门店 */
   private async assertCanMutateStore(
     account: { isPrimary: number; permissions?: unknown },
     partnerAccountId: bigint,
@@ -1002,10 +1002,17 @@ export class StoreService {
     const perms = this.partnerPermissionList(account);
     const canManage = perms.includes('store:manage');
     const canCreate = perms.includes('store:create');
-    if (!canManage && !canCreate) {
+    const legacyStoreStaff = perms.length === 0;
+    const warehouseOnly =
+      !canManage &&
+      !canCreate &&
+      !legacyStoreStaff &&
+      (perms.includes('warehouse:manage') ||
+        (perms.includes('order:view') && !perms.includes('store:create') && !perms.includes('store:manage')));
+    if (warehouseOnly || (!canManage && !canCreate && !legacyStoreStaff)) {
       throw new ForbiddenException('子账号无门店管理权限');
     }
-    // store:manage 可管团队门店；仅 store:create 只能改自己录入的店
+    // store:manage 可管团队门店；仅 store:create / 历史空权限只能改自己录入的店
     if (canManage) return;
     await this.assertStoreOwnedByAccount(partnerAccountId, storeId);
   }