feat(aihr): 重构运营后台与租户知识治理

- 重构运营总览、侧栏和内容运营工作台\n- 增加大喇叭、成果审核与运营统计链路\n- 补齐租户、知识空间、分类和知识维护闭环\n- 加固标签页租户上下文、停用租户写保护与迁移预检

frontend/src/permission.ts

@@ -1,5 +1,7 @@
 import { to as tos } from 'await-to-js';
 import router from './router';
+import type { RouteLocationNormalized } from 'vue-router';
+import { canAccessMatchedRoutes } from './router/access';
 import NProgress from 'nprogress';
 import 'nprogress/nprogress.css';
 import { getToken } from '@/utils/auth';
@@ -17,6 +19,8 @@ const isWhiteList = (path: string) => {
   return whiteList.some((pattern) => isPathMatch(pattern, path));
 };
 
+const canAccessRoute = (to: RouteLocationNormalized): boolean => canAccessMatchedRoutes(useUserStore().roles, to.matched);
+
 router.beforeEach(async (to, from, next) => {
   NProgress.start();
   if (getToken()) {
@@ -49,7 +53,12 @@ router.beforeEach(async (to, from, next) => {
           next({ path: to.path, replace: true, params: to.params, query: to.query, hash: to.hash, name: to.name as string }); // hack方法 确保addRoutes已完成
         }
       } else {
-        next();
+        if (canAccessRoute(to)) {
+          next();
+        } else {
+          next({ path: '/401', replace: true });
+          NProgress.done();
+        }
       }
     }
   } else {