UX-2（操作级权限控制）

frontend/src/views/Finance.vue

@@ -25,7 +25,9 @@
           @change="loadList"
         />
         <div class="spacer" />
-        <el-button type="primary" v-if="canCreate" @click="showForm = true">新建费用</el-button>
+        <PermissionAction action="finance.create">
+          <el-button type="primary" @click="showForm = true">新建费用</el-button>
+        </PermissionAction>
       </div>
     </el-card>
 
@@ -71,6 +73,8 @@ import FinanceForm from "../components/FinanceForm.vue";
 import { fetchFinanceItems, fetchFinanceSummary } from "../api/finance";
 import { useStudyStore } from "../store/study";
 import { useAuthStore } from "../store/auth";
+import PermissionAction from "../components/PermissionAction.vue";
+import { usePermission } from "../utils/permission";
 
 const study = useStudyStore();
 const auth = useAuthStore();
@@ -95,10 +99,8 @@ const categories = ["SITE_FEE", "SUBJECT_STIPEND", "TRAVEL", "OTHER"];
 
 const showForm = ref(false);
 
-const canCreate = computed(() => {
-  const role = auth.user?.role;
-  return role === "ADMIN" || role === "PM" || role === "CRA";
-});
+const { can } = usePermission();
+const canCreate = computed(() => can("finance.create"));
 
 const formatAmount = (num?: number | string) => {
   const n = Number(num);