feat(followup-audio): add independent assignable recording permission

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -86,7 +86,8 @@ class AuthMiddleware
                 'create', 'lists', 'detail', 'savedraft', 'apply', 'retry', 'audio', 'delete', 'reextract'];
             $action = substr($accessUri, strlen('tcm.followupaudio/'));
             $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
-            if (in_array($action, $allowed, true) && in_array('tcm.diagnosis/edit', $uris, true)) {
+            if (in_array($action, $allowed, true) && in_array('tcm.diagnosis/edit', $uris, true)
+                && in_array('tcm.diagnosis/followupaudio', $uris, true)) {
                 return $next($request); // The service also checks the current patient scope and daily permissions.
             }
             return JsonService::fail('权限不足，无法访问或操作');

server/app/common/service/followupaudio/FollowupAudioAccess.php

@@ -50,6 +50,7 @@ final class FollowupAudioAccess
         $row = Db::name('tcm_diagnosis')->where('id', $diagnosisId)->whereNull('delete_time')->lock(true)->find();
         $info = self::actor($actor);
         if (!$row || !self::allowed($actor, $info, 'tcm.diagnosis/edit')
+            || !self::allowed($actor, $info, 'tcm.diagnosis/followupAudio')
             || ($daily && !self::allowed($actor, $info, 'tcm.diagnosis/dailyRecord'))) {
             throw new DomainException('诊单不存在或无权操作');
         }