feat: 多租户数据权限 + 数据库连接修正

- adminPool 连服务器本地 5432 sbrain_admin (SCRAM 认证)
- tenantPool/pool 连 FRP 隧道 15432 bill_query (trust 认证)
- query() 自动注入 store_code 数据权限 (store/regional 角色)
- 区域经理 region 字段存储逗号分隔的 store_code 列表
- /overview 和 /overview/daily 对 scoped 用户从 bill_fact 聚合
- tenant_users.region 扩展为 VARCHAR(500)
- deploy.sh .env 增加 ADMIN_DB_* 配置
- run.md 更新数据库连接架构说明
- 新增海淀区区域经理用户 (21 家海淀区门店)

server/src/index.ts

@@ -3,6 +3,7 @@ import express from 'express'
 import cors from 'cors'
 import { authMiddleware, AuthRequest } from './middleware/auth.js'
 import { errorHandler, notFoundHandler } from './middleware/error.js'
+import { tenantDbMiddleware } from './middleware/tenant-db.js'
 import authRoutes from './routes/auth.js'
 import dataRoutes from './routes/data.js'
 import taskRoutes from './routes/tasks.js'
@@ -11,6 +12,7 @@ import storeExpenseRoutes from './routes/store-expense.js'
 import smartSchedulingRoutes from './routes/smart-scheduling.js'
 import situationalAwarenessRoutes from './routes/situational-awareness.js'
 import analyticsEnhancedRoutes from './routes/analytics-enhanced.js'
+import adminRoutes from './routes/admin.js'
 
 const app = express()
 const PORT = parseInt(process.env.PORT || '3333')
@@ -27,6 +29,12 @@ app.get('/api/health', (req, res) => {
 
 app.use('/api/auth', authRoutes)
 
+// admin login 不需要 auth 中间件
+app.post('/api/admin/login', (req, res, next) => {
+  req.url = '/login'
+  adminRoutes(req, res, next)
+})
+
 app.use((req, res, next) => {
   if (req.path === '/api/health' || req.path.startsWith('/api/auth')) {
     return next()
@@ -34,6 +42,16 @@ app.use((req, res, next) => {
   authMiddleware(req as AuthRequest, res, next)
 })
 
+app.use('/api/admin', adminRoutes)
+
+// 租户数据隔离中间件：根据 JWT 中的 tenantId 动态切换数据库连接池
+app.use((req, res, next) => {
+  if (req.path.startsWith('/api/admin') || req.path === '/api/health' || req.path.startsWith('/api/auth')) {
+    return next()
+  }
+  tenantDbMiddleware(req as AuthRequest, res, next)
+})
+
 app.use('/api', dataRoutes)
 app.use('/api/tasks', taskRoutes)
 app.use('/api/cost-analysis', costAnalysisRoutes)