feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

packages/shared-types/src/hq-permissions.ts

@@ -19,6 +19,9 @@ export const HQ_PERMISSION_CATALOG = [
   { key: 'knowledge_bases', label: '知识库', group: '业务' },
   { key: 'resources', label: 'OSS 资源库', group: '业务' },
   { key: 'logs', label: '日志', group: '业务' },
+  { key: 'users_delete', label: '删除用户', group: '危险操作' },
+  { key: 'orders_delete', label: '删除订单', group: '危险操作' },
+  { key: 'cities_delete', label: '删除城市', group: '危险操作' },
   { key: 'hq_permissions', label: '权限分配', group: '管理' },
   { key: 'hq_accounts', label: 'HQ 账户', group: '管理' },
   { key: 'system_settings_feature', label: '功能开关', group: '系统设置' },
@@ -33,6 +36,21 @@ export const HQ_PERMISSION_CATALOG = [
 
 export type HqPermissionKey = (typeof HQ_PERMISSION_CATALOG)[number]['key'];
 
+/** 危险操作：角色默认与超管自动权限均不含，需在权限分配中显式勾选 */
+export const HQ_DANGEROUS_PERMISSION_KEYS = [
+  'users_delete',
+  'orders_delete',
+  'cities_delete',
+] as const satisfies readonly HqPermissionKey[];
+
+export function isHqDangerousPermission(key: string): boolean {
+  return (HQ_DANGEROUS_PERMISSION_KEYS as readonly string[]).includes(key);
+}
+
+export function hqBasePermissionKeys(): HqPermissionKey[] {
+  return HQ_PERMISSION_CATALOG.map((p) => p.key).filter((k) => !isHqDangerousPermission(k));
+}
+
 /** 系统配置 registry group → 权限 key */
 export const SYSTEM_CONFIG_GROUP_PERMISSION: Record<string, HqPermissionKey> = {
   feature: 'system_settings_feature',
@@ -76,7 +94,7 @@ export const HQ_ADMIN_ROLES = [
 ] as const;
 
 export const HQ_ROLE_DEFAULT_PERMISSIONS: Record<string, HqPermissionKey[]> = {
-  SUPER_ADMIN: HQ_PERMISSION_CATALOG.map((p) => p.key),
+  SUPER_ADMIN: hqBasePermissionKeys(),
   OPS: [
     'dashboard',
     'users',