feat: add system operations dashboard

frontend/tests/router-menu-contract.test.ts

@@ -11,7 +11,7 @@ import { canAccess, filterMenu, hasRoleAccess } from '../src/store/modules/menu-
 describe('router and TDesign menu contracts', () => {
   it('keeps every PAGE route declared and the static deep-link fallback in the router', () => {
     expect(routesContract.routes.map((route) => route.pageId).sort()).toEqual(
-      Array.from({ length: 23 }, (_, index) => `PAGE-${String(index + 1).padStart(2, '0')}`),
+      Array.from({ length: 24 }, (_, index) => `PAGE-${String(index + 1).padStart(2, '0')}`),
     );
     expect(routesContract.routes.find((route) => route.pageId === 'PAGE-15')?.path).toBe('/finance/payments');
     expect(readFileSync(resolve(process.cwd(), 'src/router/index.ts'), 'utf8')).toContain('createWebHistory');
@@ -32,12 +32,31 @@ describe('router and TDesign menu contracts', () => {
       }
     };
     collectPaths(allRoutes);
+    expect(flattenedPaths).toContain('/dashboard');
     expect(flattenedPaths).toContain('/projects/');
     expect(flattenedPaths).not.toContain('/dashboard/base');
     expect(flattenedPaths).not.toContain('/detail/base');
     expect(flattenedPaths).not.toContain('/list/base');
   });
 
+  it('places the dashboard first and hides it without its dedicated permission', () => {
+    const dashboard = allRoutes.find((route) => route.path === '/dashboard');
+    expect(dashboard?.meta?.orderNo).toBe(1);
+    expect(dashboard?.children?.[0]?.meta?.permission).toBe('dashboard:overview:view');
+
+    const withoutDashboard = filterMenu(allRoutes, {
+      currentRole: 'FINANCE_MANAGER',
+      permissions: ['workflow:task:view'],
+    });
+    expect(withoutDashboard.some((route) => route.path === '/dashboard')).toBe(false);
+
+    const withDashboard = filterMenu(allRoutes, {
+      currentRole: 'CUSTOM_ROLE',
+      permissions: ['dashboard:overview:view'],
+    });
+    expect(withDashboard[0]?.path).toBe('/dashboard');
+  });
+
   it('filters menu leaves with the same role and permission rules used by route access', () => {
     const projectIdentity = { currentRole: 'PROJECT_MANAGER', permissions: ['project:project:view'] };
     const financeIdentity = {