feat: 新增 superadmin 角色和数据清空功能

后端：
- User.Role enum 增加 superadmin，启动时 ALTER TABLE 兼容已有 DB
- 新增 SuperAdminOnly() 中间件
- 新增 POST /api/v1/admin/clear-data 接口（按表名白名单删除，多租户隔离）

前端：
- AppUser/AuthUser 支持 role 字段持久化与传递
- 数据导入 Tab 末尾增加「危险操作 — 数据清空」区块（仅 superadmin 可见）
- 支持多选：入库单/出库单/库存管理/商品详情/往来单位
- 红色警告框 + 二次确认弹窗（需手动输入"确认清空"）

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

client/lib/core/auth/auth_state.dart

@@ -8,6 +8,7 @@ const _kUsername = 'username';
 const _kRealName = 'real_name';
 const _kShopNo = 'shop_no';
 const _kShopId = 'shop_id';
+const _kRole = 'role';
 
 class AuthUser {
   final String accessToken;
@@ -16,6 +17,7 @@ class AuthUser {
   final String realName;
   final String shopNo;
   final int shopId;
+  final String role;
 
   const AuthUser({
     required this.accessToken,
@@ -24,6 +26,7 @@ class AuthUser {
     required this.realName,
     required this.shopNo,
     required this.shopId,
+    this.role = 'operator',
   });
 
   // Kept for ApiClient compatibility
@@ -51,6 +54,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
       final shopNo = prefs.getString(_kShopNo);
       final shopIdStr = prefs.getString(_kShopId);
 
+      final role = prefs.getString(_kRole);
       if (accessToken != null && refreshToken != null && username != null) {
         state = AuthState(
           initialized: true,
@@ -61,6 +65,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
             realName: realName ?? username,
             shopNo: shopNo ?? '',
             shopId: int.tryParse(shopIdStr ?? '') ?? 0,
+            role: role ?? 'operator',
           ),
         );
         return;
@@ -80,6 +85,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
     await prefs.setString(_kRealName, user.realName);
     await prefs.setString(_kShopNo, user.shopNo);
     await prefs.setString(_kShopId, user.shopId.toString());
+    await prefs.setString(_kRole, user.role);
     debugPrint('[Auth] login() setting state, token prefix: ${user.accessToken.substring(0, user.accessToken.length.clamp(0, 20))}...');
     state = AuthState(initialized: true, user: user);
     debugPrint('[Auth] login() state set, isLoggedIn=${state.isLoggedIn}');
@@ -98,6 +104,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
         realName: state.user!.realName,
         shopNo: state.user!.shopNo,
         shopId: state.user!.shopId,
+        role: state.user!.role,
       ),
     );
   }
@@ -111,6 +118,7 @@ class AuthNotifier extends StateNotifier<AuthState> {
     await prefs.remove(_kRealName);
     await prefs.remove(_kShopNo);
     await prefs.remove(_kShopId);
+    await prefs.remove(_kRole);
     state = const AuthState(initialized: true);
   }
 }