refactor: 数据权限过滤从 GORM Callback 改为 Store 层显式调用

- 移除 RegisterDataPermissionCallback 和 SkipDataPermission 机制
- 在 Auth 中间件预计算 SubordinateShopIDs 并注入 Context
- 新增 ApplyShopFilter/ApplyEnterpriseFilter/ApplyOwnerShopFilter 等 Helper 函数
- 所有 Store 层查询方法显式调用数据权限过滤函数
- 权限检查函数 CanManageShop/CanManageEnterprise 改为从 Context 获取数据

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/bootstrap/middlewares.go

@@ -14,7 +14,7 @@ import (
 )
 
 // initMiddlewares 初始化所有中间件
-func initMiddlewares(deps *Dependencies) *Middlewares {
+func initMiddlewares(deps *Dependencies, stores *stores) *Middlewares {
 	// 获取全局配置
 	cfg := config.Get()
 
@@ -29,11 +29,11 @@ func initMiddlewares(deps *Dependencies) *Middlewares {
 	refreshTTL := time.Duration(cfg.JWT.RefreshTokenTTL) * time.Second
 	tokenManager := pkgauth.NewTokenManager(deps.Redis, accessTTL, refreshTTL)
 
-	// 创建后台认证中间件
-	adminAuthMiddleware := createAdminAuthMiddleware(tokenManager)
+	// 创建后台认证中间件（传入 ShopStore 以支持预计算下级店铺 ID）
+	adminAuthMiddleware := createAdminAuthMiddleware(tokenManager, stores.Shop)
 
-	// 创建H5认证中间件
-	h5AuthMiddleware := createH5AuthMiddleware(tokenManager)
+	// 创建H5认证中间件（传入 ShopStore 以支持预计算下级店铺 ID）
+	h5AuthMiddleware := createH5AuthMiddleware(tokenManager, stores.Shop)
 
 	return &Middlewares{
 		PersonalAuth: personalAuthMiddleware,
@@ -42,7 +42,7 @@ func initMiddlewares(deps *Dependencies) *Middlewares {
 	}
 }
 
-func createAdminAuthMiddleware(tokenManager *pkgauth.TokenManager) fiber.Handler {
+func createAdminAuthMiddleware(tokenManager *pkgauth.TokenManager, shopStore pkgmiddleware.AuthShopStoreInterface) fiber.Handler {
 	return pkgmiddleware.Auth(pkgmiddleware.AuthConfig{
 		TokenValidator: func(token string) (*pkgmiddleware.UserContextInfo, error) {
 			tokenInfo, err := tokenManager.ValidateAccessToken(context.Background(), token)
@@ -65,10 +65,11 @@ func createAdminAuthMiddleware(tokenManager *pkgauth.TokenManager) fiber.Handler
 			}, nil
 		},
 		SkipPaths: []string{"/api/admin/login", "/api/admin/refresh-token"},
+		ShopStore: shopStore,
 	})
 }
 
-func createH5AuthMiddleware(tokenManager *pkgauth.TokenManager) fiber.Handler {
+func createH5AuthMiddleware(tokenManager *pkgauth.TokenManager, shopStore pkgmiddleware.AuthShopStoreInterface) fiber.Handler {
 	return pkgmiddleware.Auth(pkgmiddleware.AuthConfig{
 		TokenValidator: func(token string) (*pkgmiddleware.UserContextInfo, error) {
 			tokenInfo, err := tokenManager.ValidateAccessToken(context.Background(), token)
@@ -90,5 +91,6 @@ func createH5AuthMiddleware(tokenManager *pkgauth.TokenManager) fiber.Handler {
 			}, nil
 		},
 		SkipPaths: []string{"/api/h5/login", "/api/h5/refresh-token"},
+		ShopStore: shopStore,
 	})
 }