fix: 资金操作接口增加权限校验，低权限账号不再能操作资金

- 提现申请/审核/打款确认：@SaCheckPermission("withdrawnRecord.modify")
- 用户退款处理/批量退款/代申请退款：@SaCheckPermission("refundLog.modify")
- 手动触发结算/确认结算：@SaCheckPermission("settlement.modify")（新增权限）
- 新增 v21 迁移脚本：settlement.modify 权限记录 + 自动授权给已拥有
  settlement.list 的角色，现有角色功能不中断，超管自动补齐

Co-Authored-By: Claude <noreply@anthropic.com>

car-wash-admin/src/main/java/com/kym/admin/controller/FinanceController.java

@@ -75,6 +75,7 @@ public class FinanceController {
      * @param params
      * @return
      */
+    @SaCheckPermission("withdrawnRecord.modify")
     @PostMapping("/applyWithdrawn")
     public R<?> applyWithdrawn(@RequestBody WithdrawnQueryParam params) {
         stationAccountService.applyWithdrawn(params);
@@ -98,6 +99,7 @@ public class FinanceController {
      * @param params
      * @return
      */
+    @SaCheckPermission("withdrawnRecord.modify")
     @PostMapping("/reviewWithdrawn")
     public R<?> reviewWithdrawn(@RequestBody WithdrawnQueryParam params) {
         withdrawnRecordService.reviewWithdrawn(params);
@@ -110,6 +112,7 @@ public class FinanceController {
      * @param params
      * @return
      */
+    @SaCheckPermission("withdrawnRecord.modify")
     @PostMapping("/confirmWithdrawnPayment")
     public R<?> confirmWithdrawnPayment(@RequestBody WithdrawnQueryParam params) {
         withdrawnRecordService.confirmWithdrawnPayment(params);
@@ -123,6 +126,7 @@ public class FinanceController {
      * @param refundLogId
      * @return
      */
+    @SaCheckPermission("refundLog.modify")
     @SysLog("处理用户微信退款")
     @GetMapping("/customWxRefund/{refundLogId}")
     R<?> customWxRefund(@PathVariable("refundLogId") long refundLogId) {
@@ -133,6 +137,7 @@ public class FinanceController {
     /**
      * 批量处理用户退款
      */
+    @SaCheckPermission("refundLog.modify")
     @SysLog("批量处理用户微信退款")
     @PostMapping("/batchWxRefund")
     R<?> batchWxRefund(@RequestBody java.util.List<Long> refundLogIds) {
@@ -159,6 +164,7 @@ public class FinanceController {
      * @param param
      * @return
      */
+    @SaCheckPermission("refundLog.modify")
     @SysLog("用户退款申请")
     @PostMapping("/applyRefund")
     @ResponseBody
@@ -178,6 +184,7 @@ public class FinanceController {
     /**
      * 手动触发结算（运维用）
      */
+    @SaCheckPermission("settlement.modify")
     @SysLog("手动触发月度结算")
     @PostMapping("/triggerSettlement")
     public R<?> triggerSettlement() {
@@ -188,6 +195,7 @@ public class FinanceController {
     /**
      * 确认结算 — 将待结算金额转入站点可提现余额
      */
+    @SaCheckPermission("settlement.modify")
     @SysLog("确认结算")
     @PostMapping("/confirmSettlement")
     public R<?> confirmSettlement(@RequestBody Map<String, Long> params) {

car-wash-entity/src/main/resources/sql/v21_add_settlement_modify_permission.sql

@@ -0,0 +1,52 @@
+-- ====================================================
+-- v21: 新增 settlement.modify 权限（确认结算）
+-- 背景：FinanceController 的 triggerSettlement / confirmSettlement
+--       将增加 @SaCheckPermission("settlement.modify") 注解，
+--       需要先补齐权限数据，避免现有角色被 403 拦截。
+--
+-- 迁移策略：
+--   1. 新增权限记录 settlement.modify（挂到财务分组 pid=64）
+--   2. 自动授权给所有已拥有 settlement.list 的角色（保持现有功能不中断）
+--   3. 超管角色（id=1）在 v9 中拥有全部权限，此处同样补上
+-- ====================================================
+
+DROP PROCEDURE IF EXISTS add_settlement_modify_permission;
+DELIMITER //
+CREATE PROCEDURE add_settlement_modify_permission()
+BEGIN
+    -- 1. 新增权限记录（幂等）
+    IF NOT EXISTS (
+        SELECT 1 FROM information_schema.TABLES
+        WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 't_permission'
+    ) THEN
+        SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 't_permission 表不存在，请先执行 init.sql';
+    END IF;
+
+    IF NOT EXISTS (
+        SELECT 1 FROM t_permission WHERE value = 'settlement.modify'
+    ) THEN
+        INSERT INTO `t_permission` (`id`, `company_id`, `name`, `value`, `pid`, `weight`)
+        VALUES (93, NULL, '确认结算', 'settlement.modify', 64, 7);
+    END IF;
+
+    -- 2. 授权给已拥有 settlement.list 的角色（管道分隔权限字符串，幂等）
+    UPDATE `t_role`
+    SET `permissions` = CONCAT(`permissions`, '|settlement.modify')
+    WHERE FIND_IN_SET('settlement.list', REPLACE(IFNULL(`permissions`, ''), '|', ',')) > 0
+      AND FIND_IN_SET('settlement.modify', REPLACE(IFNULL(`permissions`, ''), '|', ',')) = 0;
+
+    -- 3. 超管角色兜底（若其权限字符串未包含新权限）
+    UPDATE `t_role`
+    SET `permissions` = CONCAT(IFNULL(`permissions`, ''), '|settlement.modify')
+    WHERE `id` = 1
+      AND FIND_IN_SET('settlement.modify', REPLACE(IFNULL(`permissions`, ''), '|', ',')) = 0;
+END //
+DELIMITER ;
+CALL add_settlement_modify_permission();
+DROP PROCEDURE IF EXISTS add_settlement_modify_permission;
+
+-- ====================================================
+-- 验证：
+--   SELECT * FROM t_permission WHERE value = 'settlement.modify';
+--   SELECT id, role_name, permissions FROM t_role WHERE permissions LIKE '%settlement.modify%';
+-- ====================================================