feat: 权限修复、搜索改进、滑动切换、通知badge

权限:
- viewer 不能编辑公共配方（前端+后端双重限制）
- viewer 管理配方页只显示"我的配方"
- 取消 token 链接登录，改为自注册+管理员分配角色
- 用户管理页去掉创建用户和复制链接，禁止设管理员
- 修复改权限 API 路径错误

搜索:
- 模糊匹配+同义词扩展（37组），精确/相似分层
- 精确匹配不搜精油成分（避免"西班牙牛至"污染）
- 所有搜索结果底部加"通知编辑添加"按钮

UI:
- 顶部 tab 栏按用户角色显示，切换时居中滚动
- 左右滑动按 visibleTabs 顺序切换 tab
- 用户名旁红色通知数 badge

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/App.vue

@@ -15,6 +15,7 @@
         <template v-if="auth.isLoggedIn">
           <span v-if="auth.isBusiness" class="biz-badge" title="商业认证用户">🏢</span>
           <span class="user-name">{{ auth.user.display_name || auth.user.username }} ▾</span>
+          <span v-if="unreadNotifCount > 0" class="notif-badge">{{ unreadNotifCount }}</span>
         </template>
         <template v-else>
           <span class="login-btn">登录</span>
@@ -24,18 +25,15 @@
   </div>
 
   <!-- User Menu Popup -->
-  <UserMenu v-if="showUserMenu" @close="showUserMenu = false" />
+  <UserMenu v-if="showUserMenu" @close="showUserMenu = false; loadUnreadCount()" />
 
   <!-- Nav tabs -->
-  <div class="nav-tabs" :style="isPreview ? { top: '36px' } : {}">
-    <div class="nav-tab" :class="{ active: ui.currentSection === 'search' }" @click="goSection('search')">🔍 配方查询</div>
-    <div class="nav-tab" :class="{ active: ui.currentSection === 'manage' }" @click="requireLogin('manage')">📋 管理配方</div>
-    <div class="nav-tab" :class="{ active: ui.currentSection === 'inventory' }" @click="requireLogin('inventory')">📦 个人库存</div>
-    <div class="nav-tab" :class="{ active: ui.currentSection === 'oils' }" @click="goSection('oils')">💧 精油价目</div>
-    <div v-if="auth.isBusiness" class="nav-tab" :class="{ active: ui.currentSection === 'projects' }" @click="goSection('projects')">💼 商业核算</div>
-    <div v-if="auth.isAdmin" class="nav-tab" :class="{ active: ui.currentSection === 'audit' }" @click="goSection('audit')">📜 操作日志</div>
-    <div v-if="auth.isAdmin" class="nav-tab" :class="{ active: ui.currentSection === 'bugs' }" @click="goSection('bugs')">🐛 Bug</div>
-    <div v-if="auth.isAdmin" class="nav-tab" :class="{ active: ui.currentSection === 'users' }" @click="goSection('users')">👥 用户管理</div>
+  <div class="nav-tabs" ref="navTabsRef" :style="isPreview ? { top: '36px' } : {}">
+    <div v-for="tab in visibleTabs" :key="tab.key"
+      class="nav-tab"
+      :class="{ active: ui.currentSection === tab.key }"
+      @click="goSection(tab.key)"
+    >{{ tab.icon }} {{ tab.label }}</div>
   </div>
 
   <!-- Main content -->
@@ -54,7 +52,7 @@
 </template>
 
 <script setup>
-import { ref, computed, onMounted, watch } from 'vue'
+import { ref, computed, onMounted, watch, nextTick } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import { useAuthStore } from './stores/auth'
 import { useOilsStore } from './stores/oils'
@@ -63,6 +61,7 @@ import { useUiStore } from './stores/ui'
 import LoginModal from './components/LoginModal.vue'
 import CustomDialog from './components/CustomDialog.vue'
 import UserMenu from './components/UserMenu.vue'
+import { api } from './composables/useApi'
 
 const auth = useAuthStore()
 const oils = useOilsStore()
@@ -71,12 +70,52 @@ const ui = useUiStore()
 const router = useRouter()
 const route = useRoute()
 const showUserMenu = ref(false)
+const navTabsRef = ref(null)
+
+// Tab 定义，顺序固定：配方查询 → 管理配方 → 个人库存 → 精油价目 → 商业核算 → 操作日志 → Bug → 用户管理
+// require: 'login' = 需要登录, 'business' = 需要商业认证, 'admin' = 需要管理员
+const allTabs = [
+  { key: 'search',    icon: '🔍', label: '配方查询' },
+  { key: 'manage',    icon: '📋', label: '管理配方',  require: 'login' },
+  { key: 'inventory', icon: '📦', label: '个人库存',  require: 'login' },
+  { key: 'oils',      icon: '💧', label: '精油价目' },
+  { key: 'projects',  icon: '💼', label: '商业核算',  require: 'business' },
+  { key: 'audit',     icon: '📜', label: '操作日志',  require: 'admin' },
+  { key: 'bugs',      icon: '🐛', label: 'Bug',       require: 'admin' },
+  { key: 'users',     icon: '👥', label: '用户管理',  require: 'admin' },
+]
+
+// 根据当前用户角色，过滤出可见的 tab
+// 未登录: 配方查询, 精油价目
+// 普通登录: 配方查询, 管理配方, 个人库存, 精油价目
+// 商业用户: + 商业核算
+// 管理员: + 操作日志, Bug, 用户管理
+const visibleTabs = computed(() => allTabs.filter(t => {
+  if (!t.require) return true
+  if (t.require === 'login') return auth.isLoggedIn
+  if (t.require === 'business') return auth.isBusiness
+  if (t.require === 'admin') return auth.isAdmin
+  return true
+}))
+const unreadNotifCount = ref(0)
+
+async function loadUnreadCount() {
+  if (!auth.isLoggedIn) return
+  try {
+    const res = await api('/api/notifications')
+    if (res.ok) {
+      const data = await res.json()
+      unreadNotifCount.value = data.filter(n => !n.is_read).length
+    }
+  } catch {}
+}
 
 // Sync ui.currentSection from route on load and navigation
 const routeToSection = { '/': 'search', '/manage': 'manage', '/inventory': 'inventory', '/oils': 'oils', '/projects': 'projects', '/mydiary': 'mydiary', '/audit': 'audit', '/bugs': 'bugs', '/users': 'users' }
 watch(() => route.path, (path) => {
   const section = routeToSection[path] || 'search'
   ui.showSection(section)
+  nextTick(() => scrollActiveTabToCenter())
 }, { immediate: true })
 
 // Preview environment detection: pr-{id}.oil.oci.euphon.net
@@ -88,6 +127,16 @@ const prId = prMatch ? prMatch[1] : ''
 function goSection(name) {
   ui.showSection(name)
   router.push('/' + (name === 'search' ? '' : name))
+  nextTick(() => scrollActiveTabToCenter())
+}
+
+function scrollActiveTabToCenter() {
+  if (!navTabsRef.value) return
+  const active = navTabsRef.value.querySelector('.nav-tab.active')
+  if (!active) return
+  const container = navTabsRef.value
+  const scrollLeft = active.offsetLeft - container.clientWidth / 2 + active.clientWidth / 2
+  container.scrollTo({ left: scrollLeft, behavior: 'smooth' })
 }
 
 function requireLogin(name) {
@@ -106,44 +155,34 @@ function toggleUserMenu() {
   showUserMenu.value = !showUserMenu.value
 }
 
-// Swipe to switch tabs
+// ── 左右滑动切换 tab ──
+// 滑动顺序 = visibleTabs 的顺序（根据用户角色动态决定）
+// 轮播区域（data-no-tab-swipe）内的滑动不触发 tab 切换
 const swipeStartX = ref(0)
 const swipeStartY = ref(0)
 
-// Tab order for swipe navigation (only user-accessible tabs)
-const tabOrder = computed(() => {
-  const tabs = ['search', 'oils']
-  if (auth.isLoggedIn) {
-    tabs.splice(1, 0, 'manage', 'inventory')
-  }
-  if (auth.isBusiness) tabs.push('projects')
-  return tabs
-})
-
 function onSwipeStart(e) {
-  const touch = e.touches[0]
-  swipeStartX.value = touch.clientX
-  swipeStartY.value = touch.clientY
+  swipeStartX.value = e.touches[0].clientX
+  swipeStartY.value = e.touches[0].clientY
 }
 
 function onSwipeEnd(e) {
-  const touch = e.changedTouches[0]
-  const dx = touch.clientX - swipeStartX.value
-  const dy = touch.clientY - swipeStartY.value
-  // Only trigger if horizontal swipe is dominant and > 50px
+  const dx = e.changedTouches[0].clientX - swipeStartX.value
+  const dy = e.changedTouches[0].clientY - swipeStartY.value
+  // 必须是水平滑动 > 50px，且水平距离大于垂直距离
   if (Math.abs(dx) < 50 || Math.abs(dy) > Math.abs(dx)) return
-  // Check if the swipe originated inside a carousel (data-no-tab-swipe)
+  // 轮播区域内不触发 tab 切换
   if (e.target.closest && e.target.closest('[data-no-tab-swipe]')) return
 
-  const tabs = tabOrder.value
+  const tabs = visibleTabs.value.map(t => t.key)
   const currentIdx = tabs.indexOf(ui.currentSection)
   if (currentIdx < 0) return
 
-  if (dx < -50 && currentIdx < tabs.length - 1) {
-    // Swipe left -> next tab
+  if (dx < 0 && currentIdx < tabs.length - 1) {
+    // 左滑 → 下一个 tab
     goSection(tabs[currentIdx + 1])
-  } else if (dx > 50 && currentIdx > 0) {
-    // Swipe right -> previous tab
+  } else if (dx > 0 && currentIdx > 0) {
+    // 右滑 → 上一个 tab
     goSection(tabs[currentIdx - 1])
   }
 }
@@ -157,6 +196,7 @@ onMounted(async () => {
   ])
   if (auth.isLoggedIn) {
     await recipeStore.loadFavorites()
+    await loadUnreadCount()
   }
 
   // Periodic refresh
@@ -164,6 +204,7 @@ onMounted(async () => {
     if (document.visibilityState !== 'visible') return
     try {
       await auth.loadMe()
+      await loadUnreadCount()
     } catch {}
   }, 15000)
 })
@@ -217,6 +258,19 @@ onMounted(async () => {
   opacity: 0.95;
   white-space: nowrap;
 }
+.notif-badge {
+  background: #e53935;
+  color: #fff;
+  font-size: 11px;
+  font-weight: 700;
+  min-width: 18px;
+  height: 18px;
+  line-height: 18px;
+  text-align: center;
+  border-radius: 9px;
+  padding: 0 5px;
+  margin-left: 4px;
+}
 .login-btn {
   color: white;
   background: rgba(255,255,255,0.2);