feat(assets): add dimension analysis and authorized user previews

Refactor asset drilldowns with combined dimension filters, parent summaries and progressive loading. Add the hidden /who read-only permission preview with scoped authorization, identity mapping and audit logging. Refine inventory counts and AI问数 presentation.

src/shared/auth/roles.ts

@@ -34,3 +34,10 @@ export function canAccessEnergy(roles: readonly string[] | null | undefined): bo
   if (!roles || roles.length === 0) return false;
   return roles.some(r => ENERGY_ACCESS_ROLES.includes(r) || r === ENERGY_FULL_ACCESS);
 }
+
+/** Shared by normal login and permission preview; full access wins over department. */
+export function resolvePermissionLevel(roles: readonly string[]): 'full' | 'department' | 'personal' {
+  if (roles.some(role => FULL_ACCESS_ROLES.includes(role))) return 'full';
+  if (roles.some(role => DEPT_ACCESS_ROLES.includes(role))) return 'department';
+  return 'personal';
+}