feat: 负责人下钻视图+项目负责人编辑管理+企微授权自助绑定

- 任务/项目负责人 union scope：任务中心分组视图、工作台项目进度卡、收录验证列
- 项目负责人可管理自己项目：编辑/删除项目、编辑任务、分配负责人、推送、项目内建任务；堵死转移归属/越权新建/任务迁移
- 只读依赖放开给已登录：inspect_feishu、wecom_list_internal_contacts
- 企微 OAuth 自助绑定：/api/wecom-bind（state 签名校验+登录态一致性+归属冲突检查），未绑定 banner 增加入口
- 工作台项目进度卡与未绑定 banner 排版修复
- 修 user-auth 判空分支被 Turbopack dev 折叠删除导致匿名请求 500

tests/owner-scope.test.mjs

@@ -40,7 +40,29 @@ function captureDb(rowsByPattern) {
   return { db, captured };
 }
 
-test("isTaskOwner matches task owner_userid binding", async () => {
+test("isTaskOwner union-matches task owner or project owner", async () => {
+  const { db, captured } = captureDb([
+    [
+      /FROM tasks t\s+LEFT JOIN projects p ON p\.id = t\.project_id/,
+      (values) =>
+        values[0] === "task-1" &&
+        values[1] === "zhangsan" &&
+        values[2] === "zhangsan"
+          ? { id: "task-1" }
+          : null,
+    ],
+  ]);
+  assert.equal(await isTaskOwner(db, "task-1", "zhangsan"), true);
+  assert.equal(await isTaskOwner(db, "task-2", "zhangsan"), false);
+  assert.equal(captured.length, 2);
+  assert.match(
+    captured[0].sql,
+    /t\.owner_userid = \? OR p\.owner_userid = \?/,
+  );
+  assert.deepEqual(captured[0].values, ["task-1", "zhangsan", "zhangsan"]);
+});
+
+test("isTaskOwner strict mode only matches task owner_userid", async () => {
   const { db, captured } = captureDb([
     [
       /FROM tasks WHERE id = \? AND owner_userid = \?/,
@@ -50,9 +72,18 @@ test("isTaskOwner matches task owner_userid binding", async () => {
           : null,
     ],
   ]);
-  assert.equal(await isTaskOwner(db, "task-1", "zhangsan"), true);
-  assert.equal(await isTaskOwner(db, "task-2", "zhangsan"), false);
+  assert.equal(await isTaskOwner(db, "task-1", "zhangsan", { strict: true }), true);
+  assert.equal(
+    await isTaskOwner(db, "task-1", "project-owner", { strict: true }),
+    false,
+    "strict 门不允许项目负责人代操作任务负责人的客户群",
+  );
   assert.equal(captured.length, 2);
+  assert.ok(
+    !/LEFT JOIN projects/.test(captured[0].sql),
+    "strict 查询不应 JOIN projects",
+  );
+  assert.deepEqual(captured[0].values, ["task-1", "zhangsan"]);
 });
 
 test("isTaskOwner guards empty taskId / wecomUserId without querying", async () => {
@@ -63,12 +94,14 @@ test("isTaskOwner guards empty taskId / wecomUserId without querying", async ()
   assert.equal(captured.length, 0);
 });
 
-test("isDistributionOwner resolves distribution → task owner", async () => {
-  const { db } = captureDb([
+test("isDistributionOwner union-matches via task or project owner", async () => {
+  const { db, captured } = captureDb([
     [
-      /FROM distributions d\s+JOIN tasks t ON t\.id = d\.task_id/,
+      /FROM distributions d\s+JOIN tasks t ON t\.id = d\.task_id\s+LEFT JOIN projects p ON p\.id = t\.project_id/,
       (values) =>
-        values[0] === "dist-1" && values[1] === "zhangsan"
+        values[0] === "dist-1" &&
+        values[1] === "zhangsan" &&
+        values[2] === "zhangsan"
           ? { id: "dist-1" }
           : null,
     ],
@@ -76,6 +109,11 @@ test("isDistributionOwner resolves distribution → task owner", async () => {
   assert.equal(await isDistributionOwner(db, "dist-1", "zhangsan"), true);
   assert.equal(await isDistributionOwner(db, "dist-9", "zhangsan"), false);
   assert.equal(await isDistributionOwner(db, "dist-1", ""), false);
+  assert.match(
+    captured[0].sql,
+    /t\.owner_userid = \? OR p\.owner_userid = \?/,
+  );
+  assert.deepEqual(captured[0].values, ["dist-1", "zhangsan", "zhangsan"]);
 });
 
 test("ownerScopeUserid maps scope kinds to filter value", () => {
@@ -88,8 +126,11 @@ test("getTaskReportData filters by owner when ownerUserid given", async () => {
   const { db, captured } = captureDb([[/FROM tasks t/, () => []]]);
   await getTaskReportData(db, "zhangsan");
   assert.equal(captured.length, 1);
-  assert.match(captured[0].sql, /WHERE t\.owner_userid = \?/);
-  assert.deepEqual(captured[0].values, ["zhangsan"]);
+  assert.match(
+    captured[0].sql,
+    /WHERE \(t\.owner_userid = \? OR p\.owner_userid = \?\)/,
+  );
+  assert.deepEqual(captured[0].values, ["zhangsan", "zhangsan"]);
 });
 
 test("getTaskReportData keeps global aggregation without ownerUserid", async () => {