feat: 新增 approval_staff 员工角色并收紧派单候选池为审批参与人（#45）

src/test/java/com/gxwebsoft/approval/ApprovalConfirmArchiveIT.java

@@ -148,25 +148,6 @@ class ApprovalConfirmArchiveIT {
       + "AND action = 'CONFIRM' AND opinion IS NOT NULL", instanceId)).isZero();
   }
 
-  /**
-   * 回归 #45：按 #11/#14，存档确认是报送人本人的动作，不应要求 approval:instance:approve。
-   * 当前实现 403，掩盖于测试给 reporter 免费发放 APPROVE；待决策（权限授予或改 @PreAuthorize）后
-   * 按结论启用或改写本用例。
-   */
-  @Test
-  @org.junit.jupiter.api.Disabled("待 #45 决策：仅持 submit 的报送人当前无法确认自己的存档任务")
-  void reporterWithoutApproveAuthorityConfirmsOwnArchiveTask() throws Exception {
-    long instanceId = createAndSubmit("最小权限存档");
-    approveByLeader(instanceId);
-    long reporterTask = pendingTaskId(instanceId, reporter.userId);
-
-    mockMvc.perform(authed(post("/api/approval/task/" + reporterTask + "/confirm"),
-        reporter, organizationId, SUBMIT))
-      .andExpect(status().isOk())
-      .andExpect(jsonPath("$.code").value(0))
-      .andExpect(jsonPath("$.data.status").value("APPROVED"));
-  }
-
   @Test
   void archivesOnceAndCancelsOtherArchiveTasks() throws Exception {
     long instanceId = createAndSubmit("归档或签");

src/test/java/com/gxwebsoft/approval/ApprovalDispatchIT.java

@@ -89,14 +89,18 @@ class ApprovalDispatchIT {
     data.bindTenant(acceptLeader.userId, acceptLeaderRole.roleId, TENANT);
     acceptMember = data.createUser("派单受理成员" + data.uniqueSuffix(), acceptOrgId, TENANT);
 
+    // 候选池只含审批参与人（#45）：报送人/受理成员持 approval_staff
+    ApprovalTestData.TestRole staffRole = data.createRole("approval_staff", "员工", TENANT);
+    data.bindTenant(reporter.userId, staffRole.roleId, TENANT);
+    data.bindTenant(acceptMember.userId, staffRole.roleId, TENANT);
+
     ApprovalTestData.TestRole archivistRole = data.createRole("approval_archivist", "收文员", TENANT);
     archivist = data.createUser("派单收文员" + data.uniqueSuffix(), reportOrgId, TENANT);
     data.bindTenant(archivist.userId, archivistRole.roleId, TENANT);
 
     outsider = data.createUser("派单路人" + data.uniqueSuffix(), reportOrgId, TENANT);
 
-    // 回退候选：无部门但持有业务角色应保留，仅有 user/guest 角色或无角色的普通消费用户被排除
-    ApprovalTestData.TestRole staffRole = data.createRole("backoffice_staff", "业务管理员", TENANT);
+    // 回退候选：无部门但持有审批参与角色的用户保留；user/guest 或无角色一律排除
     staffNoOrg = data.createUser("派单无部门业务员" + data.uniqueSuffix(), null, TENANT);
     data.bindTenant(staffNoOrg.userId, staffRole.roleId, TENANT);