修复权限bug

tests/auth-permissions.test.ts

@@ -33,6 +33,12 @@ describe("auth permission helpers", () => {
     expect(hasAdminAccess({ ...baseUser, username: "ops-admin", subject: "ops-admin", authorities: [] })).toBe(true);
   });
 
+  it("uses configured admin usernames without falling back to default authority grants", () => {
+    vi.stubEnv("ZHINIAN_ADMIN_USERS", "admin");
+    expect(hasAdminAccess({ ...baseUser, username: "staff", subject: "staff", authorities: ["sys_user_view"] })).toBe(false);
+    expect(hasAdminAccess({ ...baseUser, username: "admin", subject: "admin", authorities: [] })).toBe(true);
+  });
+
   it("accepts configured admin authorities and normalizes case", () => {
     vi.stubEnv("ZHINIAN_ADMIN_AUTHORITIES", "custom-admin, sys_config_view");
     expect(configuredAdminAuthorities()).toEqual(["custom-admin", "sys_config_view"]);