fix(M09-REGRESSION): 完成商品逐单对账与权限收口

backend/tests/product-order-route.test.mjs

@@ -38,6 +38,9 @@ const service = {
     items: [order], total: 1, page: input.page, pageSize: input.pageSize
   })),
   getForManagement: record('getForManagement', () => order),
+  reconcileForManagement: record('reconcileForManagement', () => ({
+    order: { id: '101', orderNo: 'PG101' }, consistent: true, checks: []
+  })),
   managementAction: record('managementAction', (_actor, _id, input) => ({
     ...order, status: input.action === 'ACCEPT' ? 'ACCEPTED' : order.status
   })),
@@ -146,6 +149,11 @@ const managementList = await app.inject({
 assert.equal(managementList.statusCode, 200);
 const managementCall = calls.find((call) => call.method === 'listForManagement');
 assert.equal(managementCall.args[0].source, 'MANAGEMENT');
+const reconciliation = await app.inject({
+  method: 'GET', url: '/admin-api/product-orders/101/reconciliation', headers
+});
+assert.equal(reconciliation.statusCode, 200);
+assert.equal(reconciliation.json().data.consistent, true);
 
 const readOnlyAction = await app.inject({
   method: 'POST', url: '/admin-api/product-orders/101/actions', headers,
@@ -170,5 +178,16 @@ const refundCompleted = await app.inject({
 assert.equal(refundCompleted.statusCode, 200);
 assert.equal(refundCompleted.json().data.status, 'SUCCEEDED');
 
+currentAccess = {
+  roles: ['STAFF'], capabilities: ['platform.manage'], storeIds: []
+};
+assert.equal((await app.inject({
+  method: 'GET', url: '/admin-api/product-orders?storeId=11', headers
+})).statusCode, 200, 'platform.manage must authorize product-order reads');
+assert.equal((await app.inject({
+  method: 'POST', url: '/admin-api/product-orders/101/actions', headers,
+  payload: { requestId: 'platform-accept-1', action: 'ACCEPT', reason: '' }
+})).statusCode, 200, 'platform.manage must authorize product-order writes');
+
 await app.close();
 console.log('PASS: M09-D2 product order routes enforce customer ownership, management permissions and test payment boundaries.');