feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/common/guards/hq-permission.guard.ts

@@ -7,10 +7,10 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import {
-  HQ_PERMISSION_CATALOG,
   HQ_ROLE_DEFAULT_PERMISSIONS,
   expandHqPermissionKeys,
   hasAnySystemSettingsPermission,
+  hqBasePermissionKeys,
   type HqPermissionKey,
 } from '@dukang/shared-types';
 import { PrismaService } from '../prisma/prisma.module';
@@ -35,30 +35,29 @@ export class HqPermissionsResolver {
     if (!account || account.status !== 'ACTIVE') {
       throw new ForbiddenException('HQ 账号不可用');
     }
+
+    const userRows = await this.prisma.hqAccountPermission.findMany({
+      where: { hqAccountId: actorId },
+      select: { permissionKey: true },
+    });
+    const userKeys = userRows.map((r) => r.permissionKey);
+
     if (account.adminRole === 'SUPER_ADMIN') {
-      return HQ_PERMISSION_CATALOG.map((p) => p.key);
+      // 超管默认拥有业务/管理权限，但不含危险操作；危险权限需按用户显式勾选
+      return expandHqPermissionKeys([...hqBasePermissionKeys(), ...userKeys]);
     }
 
-    const [roleRows, userRows] = await Promise.all([
-      this.prisma.hqRolePermission.findMany({
-        where: { adminRole: account.adminRole },
-        select: { permissionKey: true },
-      }),
-      this.prisma.hqAccountPermission.findMany({
-        where: { hqAccountId: actorId },
-        select: { permissionKey: true },
-      }),
-    ]);
+    const roleRows = await this.prisma.hqRolePermission.findMany({
+      where: { adminRole: account.adminRole },
+      select: { permissionKey: true },
+    });
 
     const roleKeys =
       roleRows.length > 0
         ? roleRows.map((r) => r.permissionKey)
         : [...(HQ_ROLE_DEFAULT_PERMISSIONS[account.adminRole] ?? [])];
 
-    return expandHqPermissionKeys([
-      ...roleKeys,
-      ...userRows.map((r) => r.permissionKey),
-    ]);
+    return expandHqPermissionKeys([...roleKeys, ...userKeys]);
   }
 }