feat: 权限修复、搜索改进、滑动切换、通知badge

权限:
- viewer 不能编辑公共配方（前端+后端双重限制）
- viewer 管理配方页只显示"我的配方"
- 取消 token 链接登录，改为自注册+管理员分配角色
- 用户管理页去掉创建用户和复制链接，禁止设管理员
- 修复改权限 API 路径错误

搜索:
- 模糊匹配+同义词扩展（37组），精确/相似分层
- 精确匹配不搜精油成分（避免"西班牙牛至"污染）
- 所有搜索结果底部加"通知编辑添加"按钮

UI:
- 顶部 tab 栏按用户角色显示，切换时居中滚动
- 左右滑动按 visibleTabs 顺序切换 tab
- 用户名旁红色通知数 badge

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/main.py

@@ -324,7 +324,7 @@ def symptom_search(body: dict, user=Depends(get_current_user)):
     # If user reports no match, notify editors
     if body.get("report_missing"):
         who = user.get("display_name") or user.get("username") or "用户"
-        for role in ("admin", "senior_editor"):
+        for role in ("admin", "senior_editor", "editor"):
             conn.execute(
                 "INSERT INTO notifications (target_role, title, body) VALUES (?, ?, ?)",
                 (role, "🔍 用户需求：" + query,

frontend/src/App.vue

@@ -32,7 +32,7 @@
     <div v-for="tab in visibleTabs" :key="tab.key"
       class="nav-tab"
       :class="{ active: ui.currentSection === tab.key }"
-      @click="handleTabClick(tab)"
+      @click="goSection(tab.key)"
     >{{ tab.icon }} {{ tab.label }}</div>
   </div>
 
@@ -72,24 +72,29 @@ const route = useRoute()
 const showUserMenu = ref(false)
 const navTabsRef = ref(null)
 
-// Tab 定义，顺序固定
+// Tab 定义，顺序固定：配方查询 → 管理配方 → 个人库存 → 精油价目 → 商业核算 → 操作日志 → Bug → 用户管理
-// require: 点击时需要的条件，不满足则提示
+// require: 'login' = 需要登录, 'business' = 需要商业认证, 'admin' = 需要管理员
-// hide: 完全隐藏（只有满足条件才显示）
 const allTabs = [
   { key: 'search',    icon: '🔍', label: '配方查询' },
   { key: 'manage',    icon: '📋', label: '管理配方',  require: 'login' },
   { key: 'inventory', icon: '📦', label: '个人库存',  require: 'login' },
   { key: 'oils',      icon: '💧', label: '精油价目' },
-  { key: 'projects',  icon: '💼', label: '商业核算',  require: 'login' },
+  { key: 'projects',  icon: '💼', label: '商业核算',  require: 'business' },
-  { key: 'audit',     icon: '📜', label: '操作日志',  hide: 'admin' },
+  { key: 'audit',     icon: '📜', label: '操作日志',  require: 'admin' },
-  { key: 'bugs',      icon: '🐛', label: 'Bug',       hide: 'admin' },
+  { key: 'bugs',      icon: '🐛', label: 'Bug',       require: 'admin' },
-  { key: 'users',     icon: '👥', label: '用户管理',  hide: 'admin' },
+  { key: 'users',     icon: '👥', label: '用户管理',  require: 'admin' },
 ]
 
-// 所有人都能看到大部分 tab，bug 和用户管理只有 admin 可见
+// 根据当前用户角色，过滤出可见的 tab
+// 未登录: 配方查询, 精油价目
+// 普通登录: 配方查询, 管理配方, 个人库存, 精油价目
+// 商业用户: + 商业核算
+// 管理员: + 操作日志, Bug, 用户管理
 const visibleTabs = computed(() => allTabs.filter(t => {
-  if (!t.hide) return true
+  if (!t.require) return true
-  if (t.hide === 'admin') return auth.isAdmin
+  if (t.require === 'login') return auth.isLoggedIn
+  if (t.require === 'business') return auth.isBusiness
+  if (t.require === 'admin') return auth.isAdmin
   return true
 }))
 const unreadNotifCount = ref(0)
@@ -119,22 +124,6 @@ const prMatch = hostname.match(/^pr-(\d+)\./)
 const isPreview = !!prMatch
 const prId = prMatch ? prMatch[1] : ''
 
-function handleTabClick(tab) {
-  if (tab.require === 'login' && !auth.isLoggedIn) {
-    ui.openLogin(() => goSection(tab.key))
-    return
-  }
-  if (tab.require === 'business' && !auth.isBusiness) {
-    if (!auth.isLoggedIn) {
-      ui.openLogin(() => goSection(tab.key))
-    } else {
-      ui.showToast('需要商业认证才能使用此功能')
-    }
-    return
-  }
-  goSection(tab.key)
-}
-
 function goSection(name) {
   ui.showSection(name)
   router.push('/' + (name === 'search' ? '' : name))
@@ -189,12 +178,12 @@ function onSwipeEnd(e) {
   const currentIdx = tabs.indexOf(ui.currentSection)
   if (currentIdx < 0) return
 
-  let nextIdx = -1
+  if (dx < 0 && currentIdx < tabs.length - 1) {
-  if (dx < 0 && currentIdx < tabs.length - 1) nextIdx = currentIdx + 1
+    // 左滑 → 下一个 tab
-  else if (dx > 0 && currentIdx > 0) nextIdx = currentIdx - 1
+    goSection(tabs[currentIdx + 1])
-  if (nextIdx >= 0) {
+  } else if (dx > 0 && currentIdx > 0) {
-    const tab = visibleTabs.value[nextIdx]
+    // 右滑 → 上一个 tab
-    handleTabClick(tab)
+    goSection(tabs[currentIdx - 1])
   }
 }
 

frontend/src/components/UserMenu.vue

@@ -163,7 +163,11 @@ function handleLogout() {
   auth.logout()
   ui.showToast('已退出登录')
   emit('close')
+  if (router.currentRoute.value.meta.requiresAuth) {
     router.push('/')
+  } else {
+    window.location.reload()
+  }
 }
 
 onMounted(loadNotifications)

frontend/src/router/index.js

@@ -10,11 +10,13 @@ const routes = [
     path: '/manage',
     name: 'RecipeManager',
     component: () => import('../views/RecipeManager.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/inventory',
     name: 'Inventory',
     component: () => import('../views/Inventory.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/oils',
@@ -25,26 +27,31 @@ const routes = [
     path: '/projects',
     name: 'Projects',
     component: () => import('../views/Projects.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/mydiary',
     name: 'MyDiary',
     component: () => import('../views/MyDiary.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/audit',
     name: 'AuditLog',
     component: () => import('../views/AuditLog.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/bugs',
     name: 'BugTracker',
     component: () => import('../views/BugTracker.vue'),
+    meta: { requiresAuth: true },
   },
   {
     path: '/users',
     name: 'UserManagement',
     component: () => import('../views/UserManagement.vue'),
+    meta: { requiresAuth: true },
   },
 ]
 

frontend/src/views/MyDiary.vue

@@ -241,7 +241,7 @@
       </div>
 
       <!-- Business Verification -->
-      <div v-if="!auth.isBusiness" ref="bizCertRef" class="section-card">
+      <div v-if="!auth.isBusiness" class="section-card">
         <h4>💼 商业认证</h4>
         <p class="hint-text">申请商业认证后可使用商业核算功能。</p>
         <div class="form-group">
@@ -259,8 +259,8 @@
 </template>
 
 <script setup>
-import { ref, nextTick, onMounted, watch } from 'vue'
+import { ref, onMounted, watch } from 'vue'
-import { useRouter, useRoute } from 'vue-router'
+import { useRouter } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import { useOilsStore } from '../stores/oils'
 import { useDiaryStore } from '../stores/diary'
@@ -274,10 +274,8 @@ const oils = useOilsStore()
 const diaryStore = useDiaryStore()
 const ui = useUiStore()
 const router = useRouter()
-const route = useRoute()
-const bizCertRef = ref(null)
 
-const activeTab = ref(route.query.tab || 'brand')
+const activeTab = ref('brand')
 const pasteText = ref('')
 const selectedDiaryId = ref(null)
 const returnRecipeId = ref(null)
@@ -307,11 +305,6 @@ onMounted(async () => {
   displayName.value = auth.user.display_name || ''
   await loadBrandSettings()
   returnRecipeId.value = localStorage.getItem('oil_return_recipe_id') || null
-  // 从商业核算跳转过来，滚到商业认证区域
-  if (route.query.section === 'biz-cert') {
-    await nextTick()
-    bizCertRef.value?.scrollIntoView({ behavior: 'smooth', block: 'center' })
-  }
 })
 
 function goBackToRecipe() {

frontend/src/views/OilReference.vue

@@ -132,7 +132,7 @@
         v-for="name in filteredOilNames"
         :key="name + '-' + cardVersion"
         class="oil-chip"
-        :class="{ 'oil-chip--inactive': getMeta(name)?.isActive === false, 'oil-chip--incomplete': auth.canManage && isIncomplete(name) }"
+        :class="{ 'oil-chip--inactive': getMeta(name)?.isActive === false, 'oil-chip--incomplete': auth.isAdmin && isIncomplete(name) }"
         :style="chipStyle(name)"
         @click="openOilDetail(name)"
       >

frontend/src/views/Projects.vue

@@ -3,7 +3,7 @@
     <!-- Project List -->
     <div class="toolbar">
       <h3 class="page-title">💼 商业核算</h3>
-      <button v-if="auth.isBusiness" class="btn-primary" @click="createProject">+ 新建项目</button>
+      <button class="btn-primary" @click="createProject">+ 新建项目</button>
     </div>
 
     <div v-if="!selectedProject" class="project-list">
@@ -23,7 +23,7 @@
             成本 {{ oils.fmtPrice(oils.calcCost(p.ingredients)) }}
           </span>
         </div>
-        <div v-if="auth.isAdmin" class="proj-actions" @click.stop>
+        <div class="proj-actions" @click.stop>
           <button class="btn-icon-sm" @click="deleteProject(p)" title="删除">🗑️</button>
         </div>
       </div>
@@ -177,7 +177,6 @@
 
 <script setup>
 import { ref, computed, onMounted } from 'vue'
-import { useRouter } from 'vue-router'
 import { useAuthStore } from '../stores/auth'
 import { useOilsStore } from '../stores/oils'
 import { useRecipesStore } from '../stores/recipes'
@@ -189,14 +188,6 @@ const auth = useAuthStore()
 const oils = useOilsStore()
 const recipeStore = useRecipesStore()
 const ui = useUiStore()
-const router = useRouter()
-
-async function showCertPrompt() {
-  const ok = await showConfirm('此功能需要商业认证，是否前往申请认证？', { okText: '去认证', cancelText: '取消' })
-  if (ok) {
-    router.push('/mydiary?tab=account&section=biz-cert')
-  }
-}
 
 const projects = ref([])
 const selectedProject = ref(null)
@@ -246,10 +237,6 @@ async function createProject() {
 }
 
 function selectProject(p) {
-  if (!auth.isBusiness) {
-    showCertPrompt()
-    return
-  }
   selectedProject.value = {
     ...p,
     ingredients: (p.ingredients || []).map(i => ({ ...i })),

frontend/src/views/RecipeSearch.vue

@@ -189,8 +189,8 @@ const selectedCategory = ref(null)
 const categories = ref([])
 const selectedRecipeIndex = ref(null)
 const selectedDiaryRecipe = ref(null)
-const showMyRecipes = ref(false)
+const showMyRecipes = ref(true)
-const showFavorites = ref(false)
+const showFavorites = ref(true)
 const catIdx = ref(0)
 const sharedCount = ref(0)