feat: scope workspace routes by organization slug

modules/core/server/permissions.ts

@@ -1,7 +1,7 @@
 import { and, eq, inArray, isNull, or } from "drizzle-orm";
 
 import { getDatabase } from "@/modules/core/server/db";
-import { permissions, rolePermissions, roles } from "@/modules/core/server/schema";
+import { organizations, permissions, rolePermissions, roles } from "@/modules/core/server/schema";
 import { ensureSystemSettings } from "@/modules/core/server/system-settings";
 import type { Permission, RoleDefinition, RoleId } from "@/modules/core/types";
 import { PERMISSIONS, ROLE_LABELS } from "@/modules/core/types";
@@ -126,9 +126,21 @@ export const SYSTEM_ROLE_DEFINITIONS: SeedRole[] = [
   {
     key: "viewer",
     scope: "organization",
-    description: "只读访客，查看老人、床位和入住信息。",
+    description: "普通用户，只读查看老人、床位和入住信息。",
     permissions: ["facility:read", "admission:read", "elder:read"],
   },
+  {
+    key: "family",
+    scope: "organization",
+    description: "亲属账号，预留给家属端与授权老人动态访问。",
+    permissions: [],
+  },
+  {
+    key: "resident",
+    scope: "organization",
+    description: "本人账号，预留给老人本人查看个人服务与健康信息。",
+    permissions: [],
+  },
 ];
 
 export async function ensureSystemDefaults(): Promise<void> {
@@ -181,6 +193,9 @@ export async function ensureSystemDefaults(): Promise<void> {
   if (inserts.length > 0) {
     await database.insert(rolePermissions).values(inserts).onConflictDoNothing();
   }
+
+  const organizationRows = await database.select({ id: organizations.id }).from(organizations);
+  await Promise.all(organizationRows.map((organization) => seedOrganizationRoles(organization.id)));
 }
 
 export async function seedOrganizationRoles(organizationId: string): Promise<void> {