feat: 全局客户名称脱敏（首尾保留+中间三个*）

- 2-3字: 首字+*** (徐***)
- 4-6字: 首2字+***+末1字 (嘉兴***司)
- 7字+: 首4字+***+末2字 (嘉兴市乍***公司)
- 覆盖所有接口: monitoring, targets, vehicles, weekly-detail

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/mileage/targets.ts

@@ -3,7 +3,7 @@ import pool from '../../db.js';
 import mileagePool from '../../mileage-db.js';
 import { getCache } from './cache.js';
 import { fetchVehicleInfoByPlates } from './vehicle-info.js';
-import { filterByPermission } from '../../auth/permissions.js';
+import { filterByPermission, maskCustomerNames } from '../../auth/permissions.js';
 
 const app = new Hono();
 
@@ -173,7 +173,7 @@ app.get('/:id/vehicles', async (c) => {
 
     const user = (c as any).get('user') as import('../../auth/types.js').AuthUser | undefined;
     const filtered = user ? filterByPermission(result, user) : result;
-    return c.json(filtered);
+    return c.json(maskCustomerNames(filtered));
   } catch (e: unknown) {
     console.error('target vehicles error:', e);
     return c.json([], 500);