feat(alarm): ICC 报警事件订阅与设备报警监控/报警派单 - 重建 device_alarm 表（迁移20261024_icc_event_alarm.sql：alarm_code 唯一、uuid、line 关联、客户、等级、事件标记、alarm_time 等 19 字段与 4 索引）并新建 alarm_dispatch 派单表（15 字段）；订阅服务 IccEventSubscribeService 复用 OAuth2 鉴权向 ICC 注册报警事件回调（POST subscribe/mqinfo，monitor 带 token、同名覆盖保活），每 30 分钟保活任务（sys_job 种子）；回调 POST /api/icc-event/callback 无鉴权仅 URL token 校验，兼容单条/数组事件解析、按 alarmCode 幂等 upsert、匹配 electric_line.line_code 回填线路客户；新增 GET /api/device-alarms（列表+今日/严重/未派单统计+客户/等级/关键词筛选）与 POST /api/device-alarms/:id/dispatch（AD 派单号、同报警重复派单拦截、电工在岗审核校验、NoticeService 站内通知）；GET /api/alarm-dispatches 台账（联电工/客户名）；前端设备报警监控页（统计卡/筛选/表格/发起报警派单弹窗/30 秒轮询+严重报警红灯闪烁与 Web Audio 蜂鸣/订阅状态弹窗）与报警派单台账页+路由；菜单 63/64、role_menu、sys_job 种子；同步 db_init/db_seed 与设计文档；端到端验证通过

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

server/src/middleware/rbac.middleware.ts

@@ -31,6 +31,10 @@ const PERMISSION_MAP: Record<string, string> = {
 	"/api/electric-lines": "device:list",
 	"/api/electric-gateways": "device:list",
 	"/api/electricity-data": "device:list",
+	"/api/icc-event/subscribe": "device:list",
+	"/api/icc-event/subscribe-status": "device:list",
+	"/api/device-alarms": "alarm:list",
+	"/api/alarm-dispatches": "alarm-dispatch:list",
 	"/api/survey-orders": "project:survey",
 	"/api/project-plans": "project:plan",
 	"/api/contracts": "project:contract",
@@ -50,10 +54,10 @@ const ADMIN_ROLE_CODE = "ADMIN";
 
 @Provide()
 export class RbacMiddleware implements IMiddleware<Context, NextFunction> {
-	// 中间件匹配范围：全局生效，跳过公开接口、仪表盘与电工 APP 接口
+	// 中间件匹配范围：全局生效，跳过公开接口、ICC 事件回调（URL token 校验）、仪表盘与电工 APP 接口
 	// /api/workers/options 与 /api/workers/recommend 放行：业务员在「项目勘察派单」页
 	// 仍可调用电工下拉与推荐接口，不受 dispatch:worker 权限限制（本次需求有意设计）
-	ignore = ["/api/auth/*", "/api/health", "/api/dashboard/*", "/api/worker-app/*", "/api/workers/options", "/api/workers/recommend"];
+	ignore = ["/api/auth/*", "/api/health", "/api/dashboard/*", "/api/worker-app/*", "/api/workers/options", "/api/workers/recommend", "/api/icc-event/callback"];
 
 	@Inject()
 	permissionService!: PermissionService;