fix: 审计修复 — ErrorBoundary 接入 + data_scope 全端点接线 + inventory.wasm

1. H1: App.tsx 接入 ErrorBoundary 包裹 Suspense，防止页面渲染错误导致白屏
2. H2: data_scope 行级权限扩展到 count/aggregate/timeseries 端点，
   所有数据查询操作现在都受 data_scope 过滤
3. M3: 进销存插件 WASM 编译部署到 apps/web/public/inventory.wasm

crates/erp-plugin/src/data_service.rs

@@ -527,6 +527,7 @@ impl PluginDataService {
         db: &sea_orm::DatabaseConnection,
         filter: Option<serde_json::Value>,
         search: Option<String>,
+        scope: Option<DataScopeParams>,
     ) -> AppResult<u64> {
         let info = resolve_entity_info(plugin_id, entity_name, tenant_id, db).await?;
 
@@ -543,7 +544,7 @@ impl PluginDataService {
             }
         };
 
-        let (sql, values) = DynamicTableManager::build_filtered_count_sql(
+        let (mut sql, mut values) = DynamicTableManager::build_filtered_count_sql(
             &info.table_name,
             tenant_id,
             filter,
@@ -551,6 +552,13 @@ impl PluginDataService {
         )
         .map_err(|e| AppError::Validation(e))?;
 
+        // 合并数据权限条件
+        let scope_condition = build_scope_sql(&scope, &info.generated_fields);
+        if !scope_condition.0.is_empty() {
+            sql = merge_scope_condition(sql, &scope_condition);
+            values.extend(scope_condition.1);
+        }
+
         #[derive(FromQueryResult)]
         struct CountResult {
             count: i64,
@@ -578,10 +586,11 @@ impl PluginDataService {
         db: &sea_orm::DatabaseConnection,
         group_by_field: &str,
         filter: Option<serde_json::Value>,
+        scope: Option<DataScopeParams>,
     ) -> AppResult<Vec<(String, i64)>> {
         let info = resolve_entity_info(plugin_id, entity_name, tenant_id, db).await?;
 
-        let (sql, values) = DynamicTableManager::build_aggregate_sql(
+        let (mut sql, mut values) = DynamicTableManager::build_aggregate_sql(
             &info.table_name,
             tenant_id,
             group_by_field,
@@ -589,6 +598,13 @@ impl PluginDataService {
         )
         .map_err(|e| AppError::Validation(e))?;
 
+        // 合并数据权限条件
+        let scope_condition = build_scope_sql(&scope, &info.generated_fields);
+        if !scope_condition.0.is_empty() {
+            sql = merge_scope_condition(sql, &scope_condition);
+            values.extend(scope_condition.1);
+        }
+
         #[derive(FromQueryResult)]
         struct AggRow {
             key: Option<String>,
@@ -621,7 +637,7 @@ impl PluginDataService {
         filter: Option<serde_json::Value>,
     ) -> AppResult<Vec<(String, i64)>> {
         // TODO: 未来版本添加 Redis 缓存层
-        Self::aggregate(plugin_id, entity_name, tenant_id, db, group_by_field, filter).await
+        Self::aggregate(plugin_id, entity_name, tenant_id, db, group_by_field, filter, None).await
     }
 
     /// 时间序列聚合 — 按时间字段截断为 day/week/month 统计计数
@@ -634,10 +650,11 @@ impl PluginDataService {
         time_grain: &str,
         start: Option<String>,
         end: Option<String>,
+        scope: Option<DataScopeParams>,
     ) -> AppResult<Vec<crate::data_dto::TimeseriesItem>> {
         let info = resolve_entity_info(plugin_id, entity_name, tenant_id, db).await?;
 
-        let (sql, values) = DynamicTableManager::build_timeseries_sql(
+        let (mut sql, mut values) = DynamicTableManager::build_timeseries_sql(
             &info.table_name,
             tenant_id,
             time_field,
@@ -647,6 +664,13 @@ impl PluginDataService {
         )
         .map_err(|e| AppError::Validation(e))?;
 
+        // 合并数据权限条件
+        let scope_condition = build_scope_sql(&scope, &info.generated_fields);
+        if !scope_condition.0.is_empty() {
+            sql = merge_scope_condition(sql, &scope_condition);
+            values.extend(scope_condition.1);
+        }
+
         #[derive(FromQueryResult)]
         struct TsRow {
             period: Option<String>,