refactor: 数据权限过滤从 GORM Callback 改为 Store 层显式调用

- 移除 RegisterDataPermissionCallback 和 SkipDataPermission 机制
- 在 Auth 中间件预计算 SubordinateShopIDs 并注入 Context
- 新增 ApplyShopFilter/ApplyEnterpriseFilter/ApplyOwnerShopFilter 等 Helper 函数
- 所有 Store 层查询方法显式调用数据权限过滤函数
- 权限检查函数 CanManageShop/CanManageEnterprise 改为从 Context 获取数据

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/service/enterprise_device/service.go

@@ -9,7 +9,6 @@ import (
 	"github.com/break/junhong_cmp_fiber/internal/store/postgres"
 	"github.com/break/junhong_cmp_fiber/pkg/constants"
 	"github.com/break/junhong_cmp_fiber/pkg/errors"
-	pkggorm "github.com/break/junhong_cmp_fiber/pkg/gorm"
 	"github.com/break/junhong_cmp_fiber/pkg/middleware"
 	"go.uber.org/zap"
 	"gorm.io/gorm"
@@ -426,10 +425,8 @@ func (s *Service) ListDevicesForEnterprise(ctx context.Context, req *dto.Enterpr
 		authMap[auth.DeviceID] = auth
 	}
 
-	skipCtx := pkggorm.SkipDataPermission(ctx)
-
 	var devices []model.Device
-	query := s.db.WithContext(skipCtx).Where("id IN ?", deviceIDs)
+	query := s.db.WithContext(ctx).Where("id IN ?", deviceIDs)
 	if req.DeviceNo != "" {
 		query = query.Where("device_no LIKE ?", "%"+req.DeviceNo+"%")
 	}
@@ -438,7 +435,7 @@ func (s *Service) ListDevicesForEnterprise(ctx context.Context, req *dto.Enterpr
 	}
 
 	var bindings []model.DeviceSimBinding
-	if err := s.db.WithContext(skipCtx).
+	if err := s.db.WithContext(ctx).
 		Where("device_id IN ? AND bind_status = 1", deviceIDs).
 		Find(&bindings).Error; err != nil {
 		return nil, errors.Wrap(errors.CodeInternalError, err, "查询设备绑定卡失败")
@@ -480,15 +477,14 @@ func (s *Service) GetDeviceDetail(ctx context.Context, deviceID uint) (*dto.Ente
 		return nil, errors.New(errors.CodeDeviceNotAuthorized, "设备未授权给此企业")
 	}
 
-	skipCtx := pkggorm.SkipDataPermission(ctx)
 
 	var device model.Device
-	if err := s.db.WithContext(skipCtx).Where("id = ?", deviceID).First(&device).Error; err != nil {
+	if err := s.db.WithContext(ctx).Where("id = ?", deviceID).First(&device).Error; err != nil {
 		return nil, errors.Wrap(errors.CodeInternalError, err, "查询设备信息失败")
 	}
 
 	var bindings []model.DeviceSimBinding
-	if err := s.db.WithContext(skipCtx).
+	if err := s.db.WithContext(ctx).
 		Where("device_id = ? AND bind_status = 1", deviceID).
 		Find(&bindings).Error; err != nil {
 		return nil, errors.Wrap(errors.CodeInternalError, err, "查询设备绑定卡失败")
@@ -502,7 +498,7 @@ func (s *Service) GetDeviceDetail(ctx context.Context, deviceID uint) (*dto.Ente
 	var cards []model.IotCard
 	cardInfos := make([]dto.DeviceCardInfo, 0)
 	if len(cardIDs) > 0 {
-		if err := s.db.WithContext(skipCtx).Where("id IN ?", cardIDs).Find(&cards).Error; err != nil {
+		if err := s.db.WithContext(ctx).Where("id IN ?", cardIDs).Find(&cards).Error; err != nil {
 			return nil, errors.Wrap(errors.CodeInternalError, err, "查询卡信息失败")
 		}
 
@@ -514,7 +510,7 @@ func (s *Service) GetDeviceDetail(ctx context.Context, deviceID uint) (*dto.Ente
 		var carriers []model.Carrier
 		carrierMap := make(map[uint]string)
 		if len(carrierIDs) > 0 {
-			if err := s.db.WithContext(skipCtx).Where("id IN ?", carrierIDs).Find(&carriers).Error; err == nil {
+			if err := s.db.WithContext(ctx).Where("id IN ?", carrierIDs).Find(&carriers).Error; err == nil {
 				for _, carrier := range carriers {
 					carrierMap[carrier.ID] = carrier.CarrierName
 				}
@@ -551,8 +547,7 @@ func (s *Service) SuspendCard(ctx context.Context, deviceID, cardID uint, req *d
 		return nil, err
 	}
 
-	skipCtx := pkggorm.SkipDataPermission(ctx)
-	if err := s.db.WithContext(skipCtx).Model(&model.IotCard{}).
+	if err := s.db.WithContext(ctx).Model(&model.IotCard{}).
 		Where("id = ?", cardID).
 		Update("network_status", 0).Error; err != nil {
 		return nil, errors.Wrap(errors.CodeInternalError, err, "停机操作失败")
@@ -569,8 +564,7 @@ func (s *Service) ResumeCard(ctx context.Context, deviceID, cardID uint, req *dt
 		return nil, err
 	}
 
-	skipCtx := pkggorm.SkipDataPermission(ctx)
-	if err := s.db.WithContext(skipCtx).Model(&model.IotCard{}).
+	if err := s.db.WithContext(ctx).Model(&model.IotCard{}).
 		Where("id = ?", cardID).
 		Update("network_status", 1).Error; err != nil {
 		return nil, errors.Wrap(errors.CodeInternalError, err, "复机操作失败")
@@ -593,17 +587,16 @@ func (s *Service) validateCardOperation(ctx context.Context, deviceID, cardID ui
 		return errors.New(errors.CodeDeviceNotAuthorized, "设备未授权给此企业")
 	}
 
-	skipCtx := pkggorm.SkipDataPermission(ctx)
 
 	var binding model.DeviceSimBinding
-	if err := s.db.WithContext(skipCtx).
+	if err := s.db.WithContext(ctx).
 		Where("device_id = ? AND iot_card_id = ? AND bind_status = 1", deviceID, cardID).
 		First(&binding).Error; err != nil {
 		return errors.New(errors.CodeForbidden, "卡不属于该设备")
 	}
 
 	var cardAuth model.EnterpriseCardAuthorization
-	if err := s.db.WithContext(skipCtx).
+	if err := s.db.WithContext(ctx).
 		Where("enterprise_id = ? AND card_id = ? AND device_auth_id IS NOT NULL AND revoked_at IS NULL", enterpriseID, cardID).
 		First(&cardAuth).Error; err != nil {
 		return errors.New(errors.CodeForbidden, "无权操作此卡")