feat(auth): 能源管理模块需要 BI-LEADER-ENERGY 角色

- 新增 ENERGY_ACCESS_ROLES 与 canAccessEnergy(roles) 守卫（全量权限角色亦可访问）
- 后端 /api/energy/* 加模块级守卫：无角色返回 403
- 前端 App.tsx 按角色动态注入 EnergyModule，无权限时主导航不显示
- dev mock 用户（前端 + 后端）追加 BI-LEADER-ENERGY 便于本地调试

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/App.tsx

@@ -10,14 +10,17 @@ import FeedbackAdminPage from './modules/admin/FeedbackAdminPage';
 import AuthProvider from './auth/AuthProvider';
 import { useAuth } from './auth/useAuth';
 import UnauthorizedPage from './auth/UnauthorizedPage';
-import { canAccessScheduling } from './shared/auth/roles';
+import { canAccessScheduling, canAccessEnergy } from './shared/auth/roles';
 
 const BASE_MODULES: ModuleConfig[] = [
   { id: 'assets',  label: '资产管理', icon: Truck, component: AssetsModule },
   { id: 'mileage', label: '里程管理', icon: Route, component: MileageModule },
-  { id: 'energy',  label: '能源管理', icon: Zap,   component: EnergyModule },
 ];
 
+const ENERGY_MODULE: ModuleConfig = {
+  id: 'energy',  label: '能源管理', icon: Zap, component: EnergyModule,
+};
+
 const SCHEDULING_MODULE: ModuleConfig = {
   id: 'scheduling', label: '智能调度', icon: Activity, component: SchedulingModule,
 };
@@ -47,10 +50,10 @@ function AuthGate() {
   }, []);
 
   const modules = useMemo(() => {
-    if (canAccessScheduling(user?.roles)) {
-      return [...BASE_MODULES, SCHEDULING_MODULE];
-    }
-    return BASE_MODULES;
+    const result = [...BASE_MODULES];
+    if (canAccessEnergy(user?.roles)) result.push(ENERGY_MODULE);
+    if (canAccessScheduling(user?.roles)) result.push(SCHEDULING_MODULE);
+    return result;
   }, [user?.roles]);
 
   if (isLoading) {