fix(assets): expose full inventory for scoped users and stabilize previews

src/server/auth/permissions.ts

@@ -1,4 +1,13 @@
 import type { AuthUser } from './types.js';
+import type { Vehicle } from '../types.js';
+import { isInventoryVehicle } from '../routes/vehicles/model.js';
+
+/** 当前库存为公共资产；非库存车辆继续遵守本人/部门权限。历史业务使用原权限过滤。 */
+export function filterAssetVehiclesByPermission(items: Vehicle[], user: AuthUser): Vehicle[] {
+  if (user.permissionLevel === 'full') return items;
+  const authorized = new Set(filterByPermission(items, user));
+  return items.filter(vehicle => isInventoryVehicle(vehicle) || authorized.has(vehicle));
+}
 
 /** 客户名称脱敏 */
 export function maskCustomerName(name: string | null): string | null {