feat: 全局客户名称脱敏（首尾保留+中间三个*）

- 2-3字: 首字+*** (徐***)
- 4-6字: 首2字+***+末1字 (嘉兴***司)
- 7字+: 首4字+***+末2字 (嘉兴市乍***公司)
- 覆盖所有接口: monitoring, targets, vehicles, weekly-detail

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/mileage/monitoring.ts

@@ -1,6 +1,6 @@
 import { Hono } from 'hono';
 import { getCache, queryDateMileage, buildDateFilters } from './cache.js';
-import { filterByPermission } from '../../auth/permissions.js';
+import { filterByPermission, maskCustomerNames } from '../../auth/permissions.js';
 import type { AuthUser } from '../../auth/types.js';
 import type { CachedVehicle, MonitoringFilters, MonitoringResponse } from './types.js';
 
@@ -115,7 +115,7 @@ app.get('/', async (c) => {
   const total = filtered.length;
 
   return c.json({
-    vehicles: paged,
+    vehicles: maskCustomerNames(paged),
     stats,
     filters,
     total,

src/server/routes/mileage/targets.ts

@@ -3,7 +3,7 @@ import pool from '../../db.js';
 import mileagePool from '../../mileage-db.js';
 import { getCache } from './cache.js';
 import { fetchVehicleInfoByPlates } from './vehicle-info.js';
-import { filterByPermission } from '../../auth/permissions.js';
+import { filterByPermission, maskCustomerNames } from '../../auth/permissions.js';
 
 const app = new Hono();
 
@@ -173,7 +173,7 @@ app.get('/:id/vehicles', async (c) => {
 
     const user = (c as any).get('user') as import('../../auth/types.js').AuthUser | undefined;
     const filtered = user ? filterByPermission(result, user) : result;
-    return c.json(filtered);
+    return c.json(maskCustomerNames(filtered));
   } catch (e: unknown) {
     console.error('target vehicles error:', e);
     return c.json([], 500);