Initialize backendized SurClaw report system

- Add React/Vite frontend for login, dashboard, reports, templates, users, settings, AI, speech, and media workflows.

- Add NestJS/Prisma/PostgreSQL backend with auth, dashboard stats, reports, templates, users, departments, settings, files, AI, speech, audit logs, and HTML sanitization.

- Add Prisma schema, migrations, seed data, persistent app sessions, Docker/Nginx deployment files, and upload volume configuration.

- Add Vitest, Playwright, backend integration tests, and project documentation for requirements, design, permissions, API contracts, testing, deployment, security, and progress.

- Configure production local fallback switch and remove unused Gemini direct dependency/env wiring.

e2e/report-permissions.spec.ts

@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import { baseTemplates, baseUsers, seedLocalStorage } from './helpers';
+
+const reports = [
+  {
+    id: 'RPT_SURGERY_SELF',
+    title: '外科本人报告',
+    patientName: '患者甲',
+    hospitalId: 'H001',
+    department: '外科',
+    content: '<p>外科本人报告</p>',
+    author: '0001',
+    authorName: '张医生',
+    createdAt: '2026-05-01',
+    status: 'completed',
+    revision: 1,
+  },
+  {
+    id: 'RPT_SURGERY_OTHER',
+    title: '外科他人报告',
+    patientName: '患者乙',
+    hospitalId: 'H002',
+    department: '外科',
+    content: '<p>外科他人报告</p>',
+    author: '0003',
+    authorName: '王医生',
+    createdAt: '2026-05-01',
+    status: 'completed',
+    revision: 1,
+  },
+  {
+    id: 'RPT_INTERNAL',
+    title: '内科报告',
+    patientName: '患者丙',
+    hospitalId: 'H003',
+    department: '内科',
+    content: '<p>内科报告</p>',
+    author: '0002',
+    authorName: '李医生',
+    createdAt: '2026-05-01',
+    status: 'completed',
+    revision: 1,
+  },
+];
+
+test('admin only sees department reports, doctor only sees own reports, super sees all', async ({ page }) => {
+  await seedLocalStorage(page, {
+    users: baseUsers,
+    templates: baseTemplates,
+    reports,
+    currentUser: baseUsers[1],
+  });
+  await page.goto('/report-manage');
+
+  await expect(page.getByText('外科本人报告')).toBeVisible();
+  await expect(page.getByText('外科他人报告')).toBeVisible();
+  await expect(page.getByText('内科报告')).not.toBeVisible();
+
+  await seedLocalStorage(page, {
+    users: baseUsers,
+    templates: baseTemplates,
+    reports,
+    currentUser: baseUsers[2],
+  });
+  await page.goto('/report-manage');
+
+  await expect(page.getByText('外科本人报告')).toBeVisible();
+  await expect(page.getByText('外科他人报告')).not.toBeVisible();
+  await expect(page.getByText('内科报告')).not.toBeVisible();
+
+  await seedLocalStorage(page, {
+    users: baseUsers,
+    templates: baseTemplates,
+    reports,
+    currentUser: baseUsers[0],
+  });
+  await page.goto('/report-manage');
+
+  await expect(page.getByText('外科本人报告')).toBeVisible();
+  await expect(page.getByText('外科他人报告')).toBeVisible();
+  await expect(page.getByText('内科报告')).toBeVisible();
+});