chore: 同步本地 v9 整改与运营能力

server-go/internal/handler/inspection.go

@@ -123,6 +123,10 @@ func createInspection(db *gorm.DB, s3 *service.S3Service, ai *service.AIClient,
 				c.JSON(http.StatusBadRequest, gin.H{"error": "roomId 不是合法的 UUID"})
 				return
 			}
+			if !canAccessRoom(db, c, &roomID) {
+				c.JSON(http.StatusForbidden, gin.H{"error": "无权在该蚕房下发起巡检"})
+				return
+			}
 			rec.RoomID = &roomID
 		}
 		if idemKey != "" {
@@ -283,7 +287,7 @@ func loadRoomRisk(db *gorm.DB, roomID string) (*float64, *float64) {
 // listInspections 巡检记录列表（roomId/limit 过滤）
 func listInspections(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		q := db.Model(&model.InspectionRecord{})
+		q := applyRoomScope(db.Model(&model.InspectionRecord{}), c, "room_id")
 		if room := c.Query("roomId"); room != "" {
 			q = q.Where("room_id = ?", room)
 		}