refactor(gerp): viewsets 方法内公司隔离查询收敛进 SDK Manager

DepartmentViewSet.search / WorkgroupViewSet.search / UserRoleViewSet.search 的「显式 CompanyUUID 强制收窄」与 FileAssetViewSet.get_queryset 的全量取数，分别改走 DepartmentManager / WorkgroupManager / RoleManager / AssetManager。

UserRoleViewSet.search 内的两处函数级 RoleManager import 上提至方法顶部，与新增的 DepartmentManager 合并为一行。

gvsds/apps/gerp/views/viewsets.py

@@ -142,10 +142,8 @@ class DepartmentViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         # 无显式公司时维持原有公司隔离（管理员看全部，普通用户只看当前公司）。
         company_param = request.query_params.get('CompanyUUID')
         if company_param:
-            try:
-                qs = SdkDepartment.objects.filter(CompanyUUID=uuid.UUID(company_param).bytes)
-            except Exception:
-                qs = SdkDepartment.objects.none()
+            from gvsdsdk.auth.managers import DepartmentManager
+            qs = DepartmentManager.QueryByCompany(company_param)
         else:
             qs = self.get_queryset()
         if keyword:
@@ -262,10 +260,8 @@ class WorkgroupViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         # 显式 CompanyUUID（批量职务弹窗工作组树）时强制按该公司过滤，超管也不豁免
         company_param = request.query_params.get('CompanyUUID')
         if company_param:
-            try:
-                qs = SdkWorkgroup.objects.filter(CompanyUUID=uuid.UUID(company_param).bytes)
-            except Exception:
-                qs = SdkWorkgroup.objects.none()
+            from gvsdsdk.auth.managers import WorkgroupManager
+            qs = WorkgroupManager.QueryByCompany(company_param)
         else:
             qs = self.get_queryset()
         if keyword:
@@ -299,6 +295,7 @@ class UserRoleViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         - keyword 匹配用户名或角色名
         - 返回 UserRoleUUID 作为值，UserName+RoleName 作为展示文本
         """
+        from gvsdsdk.auth.managers import DepartmentManager, RoleManager
         from gvsdsdk.models import Role as SdkRole
         keyword = request.query_params.get('keyword', '').strip()
         # 显式 CompanyUUID（如公司详情页批量职务弹窗）时强制按该公司过滤，超管也不豁免：
@@ -306,15 +303,11 @@ class UserRoleViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         # 无显式公司时维持原有公司隔离（管理员看全部，普通用户只看当前公司）。
         company_param = request.query_params.get('CompanyUUID')
         if company_param:
-            try:
-                qs = SdkUserRole.objects.filter(CompanyUUID=uuid.UUID(company_param).bytes)
-            except Exception:
-                qs = SdkUserRole.objects.none()
+            qs = RoleManager.QueryUserRolesByCompany(company_param)
         else:
             qs = self.get_queryset()
         # 过滤条件：UserRole 关联（UUIDField 非 FK，不能直接跨表过滤，先经 SDK 解析名称再按 UUID 过滤）
         if keyword:
-            from gvsdsdk.auth.managers import RoleManager
             user_uuids, role_uuids = RoleManager.MatchUserRoleIds(keyword)
             if user_uuids or role_uuids:
                 from django.db.models import Q
@@ -401,18 +394,15 @@ class UserRoleViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         # 部门树分组：tree=1 时附带部门树（前端"按部门树展示成员"面板用）
         if request.query_params.get('tree') == '1':
             try:
-                dept_qs = SdkDepartment.objects.all()
+                dept_qs = DepartmentManager.QueryAll()
                 # 与 UserRole 同公司隔离：显式 CompanyUUID（批量职务弹窗）强制过滤（超管不豁免）；
                 # 否则仅当前公司部门（管理员特权模式不过滤）
                 if company_param:
-                    try:
-                        dept_qs = dept_qs.filter(CompanyUUID=uuid.UUID(company_param).bytes)
-                    except Exception:
-                        dept_qs = dept_qs.none()
+                    dept_qs = DepartmentManager.QueryByCompany(company_param)
                 elif not IsAdminScopeDisabled(request):
                     current_company = getattr(request, 'current_company_uuid', None)
                     if current_company:
-                        dept_qs = dept_qs.filter(CompanyUUID=current_company)
+                        dept_qs = DepartmentManager.QueryByCompany(current_company)
                 dept_list = []
                 for d in dept_qs:
                     try:
@@ -606,9 +596,9 @@ class FileAssetViewSet(CompanyScopedMixin, viewsets.ModelViewSet):
         """
         from rest_framework.exceptions import PermissionDenied
         from gvsdsdk.auth.admin_service import IsSuperAdmin, IsTenantAdmin, IsCompanyAdmin
-        from gvsdsdk.models import Company as SdkCompany
         from gvsdsdk.model_utils import UUIDObj as _U
-        qs = SdkFileAsset.objects.all()
+        from gvsdsdk.auth.managers import AssetManager
+        qs = AssetManager.QueryAll()
         user = getattr(self.request, 'user', None)
         if IsSuperAdmin(request=self.request, user=user):
             return qs