feat: 新增客户管理全模块功能

实现客户信息、客户部门、客户账号三个子模块的完整CRUD，包含：
1. 数据库实体、DTO、控制器、服务层代码
2. RBAC权限映射与菜单种子数据扩展
3. 前端路由与API封装
4. 数据权限隔离与鉴权逻辑
5. 配套工具脚本与测试验证清单

server/src/middleware/auth.middleware.ts

@@ -26,17 +26,9 @@ export class AuthMiddleware implements IMiddleware<Context, NextFunction> {
 
       const token = authHeader.substring(7);
 
+      let decoded: any;
       try {
-        const decoded = this.tokenUtil.verifyToken(token);
-
-        ctx.state.user = {
-          userId: decoded.userId,
-          username: decoded.username,
-        };
-
-        ctx.user = ctx.state.user;
-
-        await next();
+        decoded = this.tokenUtil.verifyToken(token);
       } catch (error: any) {
         if (error.name === 'TokenExpiredError') {
           ctx.status = 401;
@@ -52,7 +44,17 @@ export class AuthMiddleware implements IMiddleware<Context, NextFunction> {
             message: '无效的认证令牌',
           };
         }
+        return;
       }
+
+      ctx.state.user = {
+        userId: decoded.userId,
+        username: decoded.username,
+      };
+
+      ctx.user = ctx.state.user;
+
+      await next();
     };
   }
 }

server/src/middleware/rbac.middleware.ts

@@ -13,6 +13,9 @@ const PERMISSION_MAP: Record<string, string> = {
   '/api/menus': 'system:menu',
   '/api/dicts': 'system:dict',
   '/api/logs': 'system:log',
+  '/api/customers': 'customer:list',
+  '/api/customer-departments': 'customer:department',
+  '/api/customer-accounts': 'customer:account',
 };
 
 // 超级管理员角色编码，拥有全部权限