feat: ship OA drafts/badges, role dual-track, and test-env deploy tooling.

Add approval instance drafts with menu badges, dual-track user/role read model and role bound names, form-designer outline docs, and bare-metal test deploy scripts. Ignore local test-server credential file.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/workflow_engine.py

@@ -13,12 +13,12 @@ from sqlalchemy.orm import Session
 from app.crud import workflow as wf_crud
 from app.models.models import (
     SysUser,
-    SysUserRole,
     WfNode,
     WfProcessInstance,
     WfTask,
     WfTransition,
 )
+from app.services.web_auth_roles import list_user_ids_with_any_effective_role_ids
 from app.services.workflow_callback import trigger_callback
 
 logger = logging.getLogger("sqxp.workflow_engine")
@@ -250,11 +250,16 @@ class WorkflowEngine:
             role_ids = config.get("roleIds", [])
             if not role_ids:
                 return []
+            user_ids = list_user_ids_with_any_effective_role_ids(
+                self.db, tenant_no=tenant_no, role_ids=role_ids
+            )
+            if not user_ids:
+                return []
             rows = (
                 self.db.query(SysUser.id)
-                .join(SysUserRole, SysUserRole.user_id == SysUser.id)
                 .filter(
-                    SysUserRole.role_id.in_(role_ids),
+                    SysUser.id.in_(user_ids),
+                    SysUser.tenant_no == tenant_no,
                     SysUser.del_flag == 0,
                     SysUser.status == "1",
                 )