feat: harden tenant access and production operations

server/db.mjs

@@ -92,6 +92,7 @@ ensureColumn("projects", "archived_at", "TEXT");
 ensureColumn("projects", "archived_by", "TEXT");
 ensureColumn("projects", "archived_from_status", "TEXT");
 ensureColumn("projects", "template_id", "TEXT NOT NULL DEFAULT 'ai-manhua-drama'");
+ensureColumn("workspace_members", "access_mode", "TEXT NOT NULL DEFAULT 'all'");
 ensureColumn("auth_sessions", "device_id", "TEXT");
 ensureColumn("auth_sessions", "risk_level", "TEXT NOT NULL DEFAULT 'medium'");
 ensureColumn("auth_sessions", "risk_score", "INTEGER NOT NULL DEFAULT 50");
@@ -200,6 +201,7 @@ function seedRoles() {
     ["art_director", "workspace", "资产美术", "角色、场景、道具、prompt 和连续性"],
     ["voice_editor", "workspace", "配音/字幕", "固定声线、TTS、字幕和 ASR"],
     ["reviewer", "workspace", "审片", "QA、审片意见和通过/驳回"],
+    ["project_guest", "workspace", "项目受限成员", "只访问被授权项目，不继承工作区其他项目"],
     ["project_editor", "project", "项目编辑", "指定项目的内容编辑"],
     ["project_viewer", "project", "项目查看者", "只读查看和下载授权交付物"]
   ];
@@ -263,6 +265,7 @@ function seedRoles() {
     art_director: ["asset:edit", "prompt:edit", "task:view", "task:complete", "job:create"],
     voice_editor: ["voice:edit", "voice:approve", "task:view", "task:complete", "job:create"],
     reviewer: ["script:read", "task:view", "task:complete", "qa:review", "voice:approve", "delivery:view"],
+    project_guest: ["script:read", "task:view", "delivery:view"],
     project_editor: ["script:read", "script:edit", "asset:edit", "prompt:edit", "voice:edit", "task:view", "task:manage", "task:complete", "job:create", "delivery:view"],
     project_viewer: ["script:read", "task:view", "delivery:view"]
   };