feat(assets): add dimension analysis and authorized user previews

Refactor asset drilldowns with combined dimension filters, parent summaries and progressive loading. Add the hidden /who read-only permission preview with scoped authorization, identity mapping and audit logging. Refine inventory counts and AI问数 presentation.

src/server/auth/middleware.ts

@@ -1,5 +1,6 @@
 import type { Context, Next } from 'hono';
 import jwt from 'jsonwebtoken';
+import { resolveVehicleManagerIds } from './manager-identity.js';
 import type { JwtPayload, AuthUser } from './types.js';
 
 const JWT_SECRET = process.env.JWT_SECRET || 'ln-bi-default-secret';
@@ -41,20 +42,22 @@ export async function authMiddleware(c: Context, next: Next) {
 
   const token = authHeader.slice(7);
 
+  let payload: JwtPayload;
   try {
-    const payload = jwt.verify(token, JWT_SECRET) as JwtPayload;
-    const user: AuthUser = {
-      userId: payload.userId,
-      userName: payload.userName,
-      loginName: payload.loginName,
-      depCode: payload.depCode,
-      depName: payload.depName,
-      permissionLevel: payload.permissionLevel,
-      roles: payload.roles ?? [],
-    };
-    c.set('user', user);
-    return next();
+    payload = jwt.verify(token, JWT_SECRET) as JwtPayload;
   } catch {
     return c.json({ error: 'Invalid or expired token' }, 401);
   }
+  const user: AuthUser = {
+    userId: payload.userId, userName: payload.userName, loginName: payload.loginName,
+    depCode: payload.depCode, depName: payload.depName,
+    permissionLevel: payload.permissionLevel, roles: payload.roles ?? [],
+  };
+  try {
+    if (user.permissionLevel === 'personal') user.managerIds = await resolveVehicleManagerIds(user.userId, user.loginName);
+  } catch {
+    return c.json({ error: '账号数据范围暂不可用，请稍后重试' }, 503);
+  }
+  c.set('user', user);
+  return next();
 }