fix: 商家订单权限与菜单一致，含本俱乐部+全局角色

Co-authored-by: Cursor <cursoragent@cursor.com>

users/views/kefu_orders.py

@@ -56,7 +56,7 @@ from orders.utils import (
 from backend.utils import (
     update_dashou_daily_by_action, update_guanshi_daily_by_action,
     update_shangjia_daily, update_zuzhang_daily_by_action,
-    verify_kefu_permission, has_merchant_order_permission, has_perm_code,
+    verify_kefu_permission, has_perm_code,
 )
 from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan
 
@@ -299,12 +299,14 @@ class KefuGetShangjiaOrderListView(APIView):
         if not username:
             return Response({'code': 400, 'msg': '缺少username'})
 
-        # 2. 公共权限校验
-        kefu, permissions = verify_kefu_permission(request, username)
+        # 2. 权限校验（与 menu-access 完全一致：须 002ac）
+        kefu, permissions = verify_kefu_permission(
+            request, getattr(request.user, 'Phone', '') or None,
+        )
         if kefu is None:
             return permissions
 
-        if not has_merchant_order_permission(permissions):
+        if not has_perm_code(permissions, '002ac'):
             return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
 
         # 4. 获取分页和筛选参数