ZC-MM-006 审计与权限回收（阶段4）

- T01: V055 audit_logs 扩展 4 字段(purpose_code/service_assignment_id/actor_role_snapshot/request_trace_id, 全可空幂等) + AuditLog/DataScopeGuard/AuthorizationAuditListener/MatchmakerServiceService 写入链路改造 + schema-h2 同步 + LATEST_MIGRATION 54→55
- T02: JwtAuthFilter 运营分支改实时查库权限回收(每请求查 operators.status + 权限, 停用即401/撤权即403, 零缓存, claims 权限降级只写不读), 不碰 SecurityConfig/JwtTokenService/用户端
- T03: getServiceDetail 持有人分支接入 SensitiveAccessLog(成功查看落行 dataType=matchmaker_service_detail, 拒绝路径只落 audit_logs DATA_SCOPE_DENIED, 双记录结构性互斥)
- T04: 写接口 404 统一防探测(transfer/revoke/end/recommend/followup/complete/转介范围违规 404 化 deny, 先审计后 404, create/assign 无资源寻址维持 403, ReferralService 消灭裸 IllegalArgumentException)
- T05: OperatorEndpointPermissionCoverageTest +3 守卫(类级 RequestMapping 前缀合成/缺类级则逐方法 PreAuthorize/matchmaker+referral 禁 PatchMapping) + run-backend-contracts CURATED 14→18
- 新增测试 4 类 20 用例: MatchmakerAuditFieldsTest / OperatorPermissionRevocationTest / MatchmakerSensitiveAccessAuditTest / MatchmakerWriteDenyUniformityTest
- 验证: mvn verify 884/884(3 skip) + UI 契约 24/24 + 后端契约门禁 198 通过; 负向注入 5(工程师)+2(QA) 判红→还原复绿; QA fresh eyes 独立验收 PASS(0 P0/P1, 2 P2 观察项移交 ZC-MM-007)
- ContactAuthorizationPolicy 维持 DEFERRED; C 端死代码退役评估 3 项留待 007/专项治理

backend/src/test/resources/schema-h2.sql

@@ -108,7 +108,10 @@ CREATE TABLE audit_logs (
   id VARCHAR(36) PRIMARY KEY, operator_id VARCHAR(36), organization_id VARCHAR(36), action VARCHAR(128),
   resource_type VARCHAR(64), resource_id VARCHAR(128), before_data CLOB, after_data CLOB, ip VARCHAR(64),
   user_agent VARCHAR(500), created_at TIMESTAMP WITH TIME ZONE,
-  updated_at TIMESTAMP WITH TIME ZONE, deleted_at TIMESTAMP WITH TIME ZONE
+  updated_at TIMESTAMP WITH TIME ZONE, deleted_at TIMESTAMP WITH TIME ZONE,
+  -- V055（ZC-MM-006 / T01）：扩展审计字段，全可空，与生产对齐
+  purpose_code VARCHAR(64), service_assignment_id VARCHAR(36),
+  actor_role_snapshot VARCHAR(128), request_trace_id VARCHAR(64)
 );
 CREATE TABLE notifications (
   id VARCHAR(36) PRIMARY KEY, user_id VARCHAR(36), type VARCHAR(32), title VARCHAR(200), content VARCHAR(2000),
@@ -547,6 +550,35 @@ CREATE TABLE operators (
 );
 CREATE UNIQUE INDEX uk_operator_username_h2 ON operators(username);
 
+-- V001 配套（ZC-MM-006 / T02）：权限四表 —— JwtAuthFilter 运营分支实时查库
+--   （PermissionMapper join role_permissions/operator_roles）在 H2 上的真实 DB 路径支撑；
+--   此前缺失导致所有 operator token 测试只能 @MockBean PermissionService 绕过。
+--   与生产 V001 对齐、按惯例去外键。
+CREATE TABLE roles (
+  id VARCHAR(36) PRIMARY KEY, code VARCHAR(64) NOT NULL, name VARCHAR(100) NOT NULL,
+  description VARCHAR(500), system_role BOOLEAN NOT NULL DEFAULT FALSE,
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  deleted_at TIMESTAMP WITH TIME ZONE
+);
+CREATE UNIQUE INDEX uk_role_code_h2 ON roles(code);
+CREATE TABLE permissions (
+  id VARCHAR(36) PRIMARY KEY, code VARCHAR(128) NOT NULL, name VARCHAR(200) NOT NULL,
+  module VARCHAR(64) NOT NULL, description VARCHAR(500),
+  created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+  deleted_at TIMESTAMP WITH TIME ZONE
+);
+CREATE UNIQUE INDEX uk_permission_code_h2 ON permissions(code);
+CREATE TABLE role_permissions (
+  role_id VARCHAR(36) NOT NULL, permission_id VARCHAR(36) NOT NULL,
+  PRIMARY KEY (role_id, permission_id)
+);
+CREATE TABLE operator_roles (
+  operator_id VARCHAR(36) NOT NULL, role_id VARCHAR(36) NOT NULL,
+  PRIMARY KEY (operator_id, role_id)
+);
+
 -- Phase 17：举报与风控三表（与 V012__add_risk_and_report_tables.sql 生产 DDL 对齐）。
 -- 此前完全缺失 → ReportService / RiskReferralService 整条真实 DB 路径零覆盖，
 -- 且 ReportServiceTest 只能写 assertTrue(true) 假绿。已补入并移出 TEST_SCHEMA_OPTIONAL_TABLES 白名单。