feat(filelib): 彻底删除改与条目可见性同权(ADR-0034,supersede ADR-0031 仅管理员条款)

能删进回收站(MANAGE)的人就能清空;无关者 404(D8)。二次确认与
node.purge 审计不变;BinView 彻底删除按钮对全部可见条目开放。

hub/test/integration/filelib-nav.test.ts

@@ -120,15 +120,15 @@ describe("binService · 恢复", () => {
 });
 
 describe("binService · 彻底删除", () => {
-  it("仅管理员;整支硬删(含子孙/授权),落 node.purge 审计", async () => {
+  it("ADR-0034:与条目可见性同权 —— 直连 MANAGE 可清空,无关者 404;整支硬删 + node.purge 审计", async () => {
     const root = await createNode(treeDeps(), ADMIN, { parentId: null, kind: "FOLDER", name: "物理" });
     const child = await createNode(treeDeps(), ADMIN, {
       parentId: root.id, kind: "PROJECT", name: "TH-141",
-      grants: [{ principalType: "USER", principalId: "u_alice", role: "EDIT" }],
+      grants: [{ principalType: "USER", principalId: "u_alice", role: "MANAGE" }],
     });
-    await softDeleteNode(treeDeps(), ADMIN, root.id); // 连根删:root 是顶
+    await softDeleteNode(treeDeps(), ADMIN, root.id); // 连根删:root 是顶;alice 在 root 上无直连 MANAGE
 
-    await expect(purgeBinEntry(binDeps(), ALICE, root.id)).rejects.toMatchObject({ statusCode: 404 });
+    await expect(purgeBinEntry(binDeps(), BOB, root.id)).rejects.toMatchObject({ statusCode: 404 });
     const { removed } = await purgeBinEntry(binDeps(), ADMIN, root.id);
     expect(removed).toBe(2);
 
@@ -138,4 +138,16 @@ describe("binService · 彻底删除", () => {
     const audits = await prisma.auditEntry.findMany({ where: { action: FILE_LIB_AUDIT_ACTIONS.nodePurge } });
     expect(audits).toHaveLength(1);
   });
+
+  it("ADR-0034:非管理员的直连 MANAGE 持有者也能彻底删除", async () => {
+    const own = await createNode(treeDeps(), ADMIN, {
+      parentId: null, kind: "PROJECT", name: "alice 项目",
+      grants: [{ principalType: "USER", principalId: "u_alice", role: "MANAGE" }],
+    });
+    await softDeleteNode(treeDeps(), ADMIN, own.id);
+
+    const { removed } = await purgeBinEntry(binDeps(), ALICE, own.id);
+    expect(removed).toBe(1);
+    expect(await prisma.fileLibNode.count({ where: { id: own.id } })).toBe(0);
+  });
 });