feat(scheduling): role-based access + align list count with qualifiedCount

- Gate 智能调度 module on BI-SCHEDULE-OPT role (or full-access roles)
  via shared canAccessScheduling helper, replacing hardcoded userId allowlist
- Thread roles[] through JWT payload → middleware → frontend nav
- Add router guard that 403s non-authorized users on /api/scheduling/*
- Emit replace_qualified suggestion for every qualified vehicle so list
  count matches the 已完成考核目标 card; recalc qualifiedCount /
  hopelessCount post-permission-filter for card↔list consistency

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/auth/login.ts

@@ -66,6 +66,7 @@ app.get('/exchange', async (c) => {
       depCode: userInfo.depCode,
       depName,
       permissionLevel,
+      roles: roleNames,
     };
 
     const token = jwt.sign(payload, JWT_SECRET, { expiresIn: '8h' });

src/server/auth/middleware.ts

@@ -35,6 +35,7 @@ export async function authMiddleware(c: Context, next: Next) {
       depCode: payload.depCode,
       depName: payload.depName,
       permissionLevel: payload.permissionLevel,
+      roles: payload.roles ?? [],
     };
     c.set('user', user);
     return next();

src/server/auth/types.ts

@@ -7,6 +7,7 @@ export interface AuthUser {
   depCode: string;
   depName: string;
   permissionLevel: PermissionLevel;
+  roles: string[];
 }
 
 export interface JwtPayload {
@@ -16,12 +17,16 @@ export interface JwtPayload {
   depCode: string;
   depName: string;
   permissionLevel: PermissionLevel;
+  roles: string[];
   iat?: number;
   exp?: number;
 }
 
-/** 全量权限角色名 */
-export const FULL_ACCESS_ROLES = ['所有权限', '数智中心', 'BI-Leader'];
-
-/** 部门级权限角色名 */
-export const DEPT_ACCESS_ROLES = ['BI-Leader-Dep'];
+// Re-export role constants and helpers from the shared module so existing
+// server imports (`from './types.js'`) keep working.
+export {
+  FULL_ACCESS_ROLES,
+  DEPT_ACCESS_ROLES,
+  SCHEDULING_ACCESS_ROLES,
+  canAccessScheduling,
+} from '../../shared/auth/roles.js';