feat(版本): 完善研发计划与预警已读

关键改动：

- 增加版本表单、发布校验和调研方向进度规则

- 扩展小宝预警已读状态、风险签名和今日证据

- 补充组长权限、加班查看范围、活动记录与相关测试

Co-Authored-By: Codex GPT-5 <codex@openai.com>

apps/web/lib/overtime.ts

@@ -1,3 +1,8 @@
+import type { AuthUser } from './auth-user';
+import type { Department, Member, RoleItem } from './members';
+import { isMemberReference } from './member-system';
+import { hasPermission } from './permissions';
+
 export interface OvertimeRecord {
   id: string;
   projectId: string;
@@ -12,6 +17,13 @@ export interface OvertimeRecord {
   createdAt: string;
 }
 
+interface OvertimeVisibilityContext {
+  viewer: AuthUser | null | undefined;
+  viewerRole: RoleItem | undefined;
+  members: Member[];
+  departments: Department[];
+}
+
 export type OvertimeReason =
   | 'requirement_change'
   | 'requirement_add'
@@ -105,3 +117,46 @@ export function calcDuration(start: string, end: string): number {
 
   return Math.round(total * 10) / 10;
 }
+
+function collectDepartmentTreeIds(departments: Department[], departmentId: string): Set<string> {
+  const ids = new Set<string>([departmentId]);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const department of departments) {
+      if (department.parentId && ids.has(department.parentId) && !ids.has(department.id)) {
+        ids.add(department.id);
+        changed = true;
+      }
+    }
+  }
+  return ids;
+}
+
+function resolveRecordMember(
+  record: OvertimeRecord,
+  members: Member[],
+  viewer: AuthUser,
+): Pick<Member, 'id' | 'name' | 'departmentId'> | null {
+  const member = members.find((item) => isMemberReference(record.person, item));
+  if (member) return member;
+  if (isMemberReference(record.person, viewer)) {
+    return { id: viewer.id, name: viewer.name, departmentId: viewer.departmentId };
+  }
+  return null;
+}
+
+export function filterOvertimeRecordsForViewer(
+  records: OvertimeRecord[],
+  context: OvertimeVisibilityContext,
+): OvertimeRecord[] {
+  const { viewer, viewerRole, members, departments } = context;
+  if (!viewer || !viewerRole || !hasPermission(viewerRole, 'overtime:view')) return [];
+  if (viewerRole.permissions.includes('*')) return records;
+
+  const visibleDepartmentIds = collectDepartmentTreeIds(departments, viewer.departmentId);
+  return records.filter((record) => {
+    const member = resolveRecordMember(record, members, viewer);
+    return !!member && visibleDepartmentIds.has(member.departmentId);
+  });
+}