fix(mp): 商品详情页加载超时 + 患者兑换权限

- 移除 getProduct 失败后的 listProducts 慢 fallback（拉 100 条），直接报错
- 处理 productId 为空时 loading 永不结束的卡死问题
- 添加 8s 加载超时保护，超时自动显示错误状态+重试按钮
- 新增迁移 000161：患者角色添加 health.points.manage 兑换权限

crates/erp-server/migration/src/lib.rs

@@ -166,6 +166,8 @@ mod m20260521_000161_consultation_media_id_and_suggestion_references;
 mod m20260521_000162_consultation_session_rating_feedback;
 mod m20260521_000163_reorganize_menus_by_business_flow;
 mod m20260521_000164_reorganize_menus_scheme_b;
+mod m20260522_000160_article_add_is_public;
+mod m20260522_000161_patient_points_manage_perm;
 
 pub struct Migrator;
 
@@ -339,6 +341,8 @@ impl MigratorTrait for Migrator {
             Box::new(m20260521_000162_consultation_session_rating_feedback::Migration),
             Box::new(m20260521_000163_reorganize_menus_by_business_flow::Migration),
             Box::new(m20260521_000164_reorganize_menus_scheme_b::Migration),
+            Box::new(m20260522_000160_article_add_is_public::Migration),
+            Box::new(m20260522_000161_patient_points_manage_perm::Migration),
         ]
     }
 }

crates/erp-server/migration/src/m20260522_000161_patient_points_manage_perm.rs

@@ -0,0 +1,37 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        // 患者角色需要 health.points.manage 权限才能兑换商品
+        db.execute_unprepared(
+            "INSERT INTO role_permissions (role_id, permission_id, tenant_id, data_scope, created_at, updated_at, created_by, updated_by, deleted_at, version) \
+             SELECT r.id, p.id, r.tenant_id, 'self', NOW(), NOW(), r.id, r.id, NULL, 1 \
+             FROM roles r \
+             JOIN permissions p ON p.tenant_id = r.tenant_id AND p.code = 'health.points.manage' AND p.deleted_at IS NULL \
+             WHERE r.code = 'patient' AND r.deleted_at IS NULL \
+             ON CONFLICT (role_id, permission_id) WHERE deleted_at IS NULL \
+             DO UPDATE SET deleted_at = NULL, version = role_permissions.version + 1, updated_at = NOW()"
+        ).await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        db.execute_unprepared(
+            "DELETE FROM role_permissions \
+             WHERE role_id IN (SELECT id FROM roles WHERE code = 'patient') \
+             AND permission_id IN (SELECT id FROM permissions WHERE code = 'health.points.manage')",
+        )
+        .await?;
+
+        Ok(())
+    }
+}