feat(scheduling): role-based access + align list count with qualifiedCount

- Gate 智能调度 module on BI-SCHEDULE-OPT role (or full-access roles)
  via shared canAccessScheduling helper, replacing hardcoded userId allowlist
- Thread roles[] through JWT payload → middleware → frontend nav
- Add router guard that 403s non-authorized users on /api/scheduling/*
- Emit replace_qualified suggestion for every qualified vehicle so list
  count matches the 已完成考核目标 card; recalc qualifiedCount /
  hopelessCount post-permission-filter for card↔list consistency

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/App.tsx

@@ -7,11 +7,7 @@ import SchedulingModule from './modules/scheduling/SchedulingModule';
 import AuthProvider from './auth/AuthProvider';
 import { useAuth } from './auth/useAuth';
 import UnauthorizedPage from './auth/UnauthorizedPage';
-
-const SCHEDULING_ALLOWED_USERS = new Set([
-  '1105261382487539712',
-  '1116631120763437056',
-]);
+import { canAccessScheduling } from './shared/auth/roles';
 
 const BASE_MODULES: ModuleConfig[] = [
   { id: 'assets', label: '资产管理', icon: Truck, component: AssetsModule },
@@ -26,11 +22,11 @@ function AuthGate() {
   const { isLoading, isAuthenticated, error, user } = useAuth();
 
   const modules = useMemo(() => {
-    if (user?.userId && SCHEDULING_ALLOWED_USERS.has(user.userId)) {
+    if (canAccessScheduling(user?.roles)) {
       return [...BASE_MODULES, SCHEDULING_MODULE];
     }
     return BASE_MODULES;
-  }, [user?.userId]);
+  }, [user?.roles]);
 
   if (isLoading) {
     return (