fix(sql): 储存证 ACL 配置按钮授权给全部角色

迁移脚本为各租户有效角色补齐 storage-cert-qc-acl 菜单，使质检/生产权限入口对全部角色可见。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/sql/migrations/2026-11-11-storage-cert-qc-field-acl.sql

@@ -1,5 +1,6 @@
 -- Issue #93：储存证质检信息字段级 ACL（质检/生产）。MySQL 5.7，可重复执行。
--- 不自动授予任何角色；管理员在角色管理中勾选「储存证质检字段权限配置」。
+-- 菜单按钮「储存证质检字段权限配置」控制弹窗 footer 的「质检权限」「生产权限」入口；
+-- 本脚本会将该按钮授权给当前租户下全部有效角色。
 
 CREATE TABLE IF NOT EXISTS biz_storage_cert_qc_acl (
   id VARCHAR(64) NOT NULL,
@@ -60,6 +61,48 @@ WHERE parent.del_flag = 0 AND parent.status = '1'
         AND existing.del_flag = 0
   );
 
+-- 给所有有效角色授予「质检权限 / 生产权限」配置按钮（同一菜单码）
+INSERT INTO sys_role_menu (
+    id, role_id, menu_id, tenant_no, order_num, remark,
+    create_by, create_dept_id, create_time, update_by, update_time, del_flag
+)
+SELECT
+    INSERT(INSERT(MD5(CONCAT('storage-cert-qc-acl-role:', r.tenant_no, ':', r.id, ':', m.id)),
+                  13, 1, '3'), 17, 1, '8'),
+    r.id,
+    m.id,
+    r.tenant_no,
+    NULL,
+    'migration: grant storage-cert-qc-acl to all roles',
+    'migration',
+    '',
+    NOW(),
+    'migration',
+    NOW(),
+    0
+FROM sys_role AS r
+JOIN sys_menu AS m
+  ON m.tenant_no = r.tenant_no
+ AND m.perms = 'cell-storage:sample-info:storage-cert-qc-acl'
+ AND m.del_flag = 0
+ AND m.status = '1'
+WHERE r.del_flag = 0
+  AND NOT EXISTS (
+      SELECT 1 FROM sys_role_menu AS existing
+      WHERE existing.role_id = r.id
+        AND existing.menu_id = m.id
+        AND existing.tenant_no = r.tenant_no
+        AND existing.del_flag = 0
+  );
+
 SELECT tenant_no, parent_id, id, menu_name, perms, status
 FROM sys_menu
 WHERE perms = 'cell-storage:sample-info:storage-cert-qc-acl' AND del_flag = 0;
+
+SELECT r.tenant_no, r.role_name, m.perms, rm.id AS role_menu_id
+FROM sys_role_menu AS rm
+JOIN sys_role AS r ON r.id = rm.role_id AND r.tenant_no = rm.tenant_no AND r.del_flag = 0
+JOIN sys_menu AS m ON m.id = rm.menu_id AND m.tenant_no = rm.tenant_no AND m.del_flag = 0
+WHERE m.perms = 'cell-storage:sample-info:storage-cert-qc-acl'
+  AND rm.del_flag = 0
+ORDER BY r.tenant_no, r.role_name;