merge: 合并 xtzd/main 的报警监控、ICC 网关/模拟量/报警订阅与菜单修复提交

冲突解决：auth.middleware.ts 与 rbac.middleware.ts 的 ignore 白名单取并集，同时保留 /api/customer-app/*（小程序客户鉴权）与 /api/icc-event/callback（ICC 事件回调 URL token 校验）。

server/src/middleware/rbac.middleware.ts

@@ -29,6 +29,12 @@ const PERMISSION_MAP: Record<string, string> = {
 	"/api/customer-equipments": "device:list",
 	"/api/smart-devices": "device:model",
 	"/api/electric-lines": "device:list",
+	"/api/electric-gateways": "device:list",
+	"/api/electricity-data": "device:list",
+	"/api/icc-event/subscribe": "device:list",
+	"/api/icc-event/subscribe-status": "device:list",
+	"/api/device-alarms": "alarm:list",
+	"/api/alarm-dispatches": "alarm-dispatch:list",
 	"/api/survey-orders": "project:survey",
 	"/api/project-plans": "project:plan",
 	"/api/contracts": "project:contract",
@@ -48,10 +54,10 @@ const ADMIN_ROLE_CODE = "ADMIN";
 
 @Provide()
 export class RbacMiddleware implements IMiddleware<Context, NextFunction> {
-	// 中间件匹配范围：全局生效，跳过公开接口、仪表盘与电工 APP 接口
+	// 中间件匹配范围：全局生效，跳过公开接口、ICC 事件回调（URL token 校验）、仪表盘、电工 APP 与小程序客户接口
 	// /api/workers/options 与 /api/workers/recommend 放行：业务员在「项目勘察派单」页
 	// 仍可调用电工下拉与推荐接口，不受 dispatch:worker 权限限制（本次需求有意设计）
-	ignore = ["/api/auth/*", "/api/health", "/api/dashboard/*", "/api/worker-app/*", "/api/customer-app/*", "/api/workers/options", "/api/workers/recommend"];
+	ignore = ["/api/auth/*", "/api/health", "/api/dashboard/*", "/api/worker-app/*", "/api/customer-app/*", "/api/workers/options", "/api/workers/recommend", "/api/icc-event/callback"];
 
 	@Inject()
 	permissionService!: PermissionService;