feat(client): 只读角色隐藏所有写按钮（WriteGuard 统一控件 + 顶栏只读标识）

- 新增 isReadonlyProvider（role == 'readonly'）+ WriteGuard 控件，统一隐藏写控件
- 入库/出库/库存/商品/基础数据/往来单位/财务/设置 各屏：只读时隐藏
  新增/编辑/删除/审核/提交/驳回/结清/盘点/导入/激活/用户管理 等写操作
- 顶栏显示「只读」标识，让只读用户明确当前权限
- 后端 middleware.ReadOnly() 仍兜底 403，UI 隐藏 + 后端拦截双保险

修正：此前误判为后端漏洞/部署 bug，实为前端写按钮未对只读隐藏。
后端经验证正确拦截只读写操作（线上 stock-in/product-options 均 403）。

121 测试通过，analyze 无 error。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/lib/screens/inventory/inventory_list_screen.dart

@@ -292,7 +292,9 @@ class _InventoryListScreenState extends ConsumerState<InventoryListScreen> {
           message: item.remark.isEmpty ? '' : item.remark,
           waitDuration: const Duration(milliseconds: 300),
           child: GestureDetector(
-            onTap: () => _editRemark(context, item),
+            onTap: ref.watch(isReadonlyProvider)
+                ? null
+                : () => _editRemark(context, item),
             child: Row(
               mainAxisSize: MainAxisSize.min,
               children: [
@@ -358,10 +360,11 @@ class _InventoryListScreenState extends ConsumerState<InventoryListScreen> {
           MobileCardField('供应商', item.supplierName),
       ],
       actions: [
-        TextButton(
-          onPressed: () => _editRemark(context, item),
-          child: const Text('备注', style: TextStyle(fontSize: 13)),
-        ),
+        if (!ref.watch(isReadonlyProvider))
+          TextButton(
+            onPressed: () => _editRemark(context, item),
+            child: const Text('备注', style: TextStyle(fontSize: 13)),
+          ),
         if (item.productId != null)
           TextButton(
             onPressed: () => _printLabel(context, item),
@@ -551,12 +554,14 @@ class _InventoryListScreenState extends ConsumerState<InventoryListScreen> {
                     ref.read(inventoryListProvider.notifier).setPageSize(s),
                 toolbar: Row(
                   children: [
-                    OutlinedButton.icon(
-                      onPressed: () => context.go('/inventory/check'),
-                      icon: const Icon(Icons.fact_check, size: 16),
-                      label: const Text('发起盘点'),
-                    ),
-                    const SizedBox(width: 8),
+                    if (!ref.watch(isReadonlyProvider)) ...[
+                      OutlinedButton.icon(
+                        onPressed: () => context.go('/inventory/check'),
+                        icon: const Icon(Icons.fact_check, size: 16),
+                        label: const Text('发起盘点'),
+                      ),
+                      const SizedBox(width: 8),
+                    ],
                     OutlinedButton.icon(
                       onPressed: () => exportExcel(
                         filename: '库存查询',