fix: 恢复全局角色权限校验，修复商家订单403

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -77,11 +77,17 @@ class _AllPermissions(list):
         return True
 
 
-def has_merchant_order_permission(permissions):
-    """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。"""
+def has_perm_code(permissions, *codes):
+    """权限码 in 检查；系统超管 _AllPermissions 视为全部通过。"""
     if isinstance(permissions, _AllPermissions):
         return True
-    return any(p in permissions for p in ('002ac', '002ab', '003aa'))
+    perms = permissions or []
+    return any(c in perms for c in codes)
+
+
+def has_merchant_order_permission(permissions):
+    """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。"""
+    return has_perm_code(permissions, '002ac', '002ab', '003aa')
 
 
 def _legacy_backend_role_permissions(phone):