fix: 俱乐部+全局角色权限并集，修复002ac校验

Co-authored-by: Cursor <cursoragent@cursor.com>

users/views/kefu_orders.py

@@ -304,8 +304,15 @@ class KefuGetShangjiaOrderListView(APIView):
         if kefu is None:
             return permissions
 
-        # 3. 检查商家订单管理权限（002ac）
-        if not has_perm_code(permissions, '002ac'):
+        from jituan.constants import CLUB_ID_DEFAULT
+        from jituan.services.admin_context import get_allowed_club_ids
+        from jituan.services.club_rbac import resolve_permission_codes_for_club
+
+        club_id = getattr(request, 'club_id', None) or CLUB_ID_DEFAULT
+        eff_codes = resolve_permission_codes_for_club(
+            request.user, club_id, list(get_allowed_club_ids(request.user)),
+        )
+        if not has_perm_code(permissions, '002ac') and '002ac' not in eff_codes:
             return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
 
         # 4. 获取分页和筛选参数