fix(M09-REGRESSION): 完成商品逐单对账与权限收口

backend/src/inventory/inventory-service.ts

@@ -310,8 +310,8 @@ export class InventoryService {
          ON p.tenant_id = s.tenant_id AND p.id = s.product_id AND p.deleted_at IS NULL
        WHERE ${where}
        ORDER BY p.sort_order, p.id, s.id
-       LIMIT ? OFFSET ?`,
-      [...params, pageSize, (page - 1) * pageSize]
+       LIMIT ${pageSize} OFFSET ${(page - 1) * pageSize}`,
+      params
     );
     return {
       items: rows.map(mapStock),
@@ -346,8 +346,8 @@ export class InventoryService {
               trace_id AS traceId, reason, metadata, created_at AS createdAt
        FROM qipai_product_inventory_ledger
        WHERE tenant_id = ? AND store_id = ? AND inventory_id = ?
-       ORDER BY id DESC LIMIT ? OFFSET ?`,
-      [...params, pageSize, (page - 1) * pageSize]
+       ORDER BY id DESC LIMIT ${pageSize} OFFSET ${(page - 1) * pageSize}`,
+      params
     );
     return {
       items: rows.map(mapLedger),
@@ -1013,6 +1013,7 @@ export class InventoryService {
   private assertStoreScope(actor: ManagementActor, storeId: string, write: boolean) {
     assertId(storeId, 'INVENTORY_STORE_ID_INVALID');
     if (actor.access.capabilities.includes('tenant.manage')
+        || actor.access.capabilities.includes('platform.manage')
         || actor.access.roles.includes('PLATFORM_ADMIN')) return;
     const capability = write ? 'inventory.adjust' : 'inventory.read';
     const hasCapability = actor.access.capabilities.includes(capability)