fix(index): 修复首页铃铛权限漏洞和非门店用户新订单提醒

- 针对铃铛红点和计数，改为仅门店角色可见
- 新订单提醒回调增加角色校验，非门店不弹Toast和震动
- 订单管理页增加访问控制，非门店自动跳回防止越权访问
- 保留消息点击事件中对角色的原有区分逻辑
- 弹窗宽度调整及登录同步逻辑未变动

src/pages/index/index.tsx

@@ -85,6 +85,8 @@ const IndexPage: React.FC = () => {
       return pageShopOrder({ page: 1, limit: 5 }).then(r => r?.list || [])
     }, []),
     onNewOrders: useCallback((count) => {
+      // 非门店店员不弹新订单提醒
+      if (!isClerkRef.current) return
       Taro.vibrateShort({ type: 'medium' })
       Taro.showToast({
         title: `您有 ${count} 条新订单`,
@@ -189,14 +191,14 @@ const IndexPage: React.FC = () => {
         </View>
         <View onClick={handleMessageClick} className='relative'>
           <Text className='text-xl'>🔔</Text>
-          {isLoggedIn && newOrderCount > 0 && (
+          {isClerk && newOrderCount > 0 && (
             <View className='absolute -top-1 -right-1 min-w-[16px] h-4 px-1 bg-red-500 rounded-full flex items-center justify-center'>
               <Text className='text-white text-[10px] leading-none font-medium'>
                 {newOrderCount > 99 ? '99+' : newOrderCount}
               </Text>
             </View>
           )}
-          {isLoggedIn && newOrderCount === 0 && (
+          {isClerk && newOrderCount === 0 && (
             <View className='absolute top-0 right-0 w-2 h-2 bg-red-500 rounded-full' />
           )}
         </View>

src/pages/store/orders/index.tsx

@@ -6,6 +6,7 @@ import type {ShopOrder, ShopOrderParam} from '@/api/shop/shopOrder/model'
 import {TenantId} from '@/config/app'
 import {useNewOrderDetector} from '@/hooks/useNewOrderDetector'
 import { getCompressedImageUrl } from '@/utils/image'
+import { getMyClerk } from '@/api/shop/shopStoreUser'
 
 definePageConfig({
     navigationBarTitleText: '订单管理',
@@ -156,6 +157,25 @@ export default function StoreOrdersPage() {
     const pageSize = 10
     const loadingRef = useRef(false)
 
+    // ─── 访问控制：仅门店店员可访问此页面 ──────────────────────
+    const [accessChecking, setAccessChecking] = useState(true)
+
+    useEffect(() => {
+        getMyClerk()
+            .then(data => {
+                if (!data) {
+                    Taro.showToast({ title: '无权访问', icon: 'none', duration: 1500 })
+                    setTimeout(() => Taro.navigateBack(), 1500)
+                } else {
+                    setAccessChecking(false)
+                }
+            })
+            .catch(() => {
+                Taro.showToast({ title: '无权访问', icon: 'none', duration: 1500 })
+                setTimeout(() => Taro.navigateBack(), 1500)
+            })
+    }, [])
+
     // ─── 新订单轮询检测 ──────────────────────────────────────────
     const { newOrderCount, clearUnread } = useNewOrderDetector({
         interval: 30000, // 30 秒轮询一次
@@ -530,6 +550,11 @@ export default function StoreOrdersPage() {
         )
     }
 
+    // 访问校验中或已拒绝：不渲染页面内容
+    if (accessChecking) {
+        return <View className='min-h-full bg-gray-50' />
+    }
+
     return (
         <View className='min-h-full bg-gray-50'>
             {/* Tab 栏 */}