fix: 商家订单权限与菜单一致，含本俱乐部+全局角色

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/club_rbac.py

@@ -156,8 +156,13 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
 
     cid = (club_id or CLUB_ID_DEFAULT).strip()
     matched = []
-    for role in Role.objects.filter(RoleStatus=1, ClubID=cid):
-        if role_uuid_bytes(role.RoleUUID) in wanted:
+    for role in Role.objects.filter(RoleStatus=1):
+        key = role_uuid_bytes(role.RoleUUID)
+        if key not in wanted:
+            continue
+        rcid = (getattr(role, 'ClubID', None) or '').strip()
+        # 本俱乐部角色 + 全局角色；不含其他俱乐部角色
+        if rcid == cid or rcid == '':
             matched.append(role.RoleUUID)
     return matched