fix(admin): 用户360画像订单归属改用 expert_id IN (本人档案 id)，与列表口径一致且避免 id 撞号

server/tests/read-scope.spec.ts

@@ -29,6 +29,10 @@ describe('第十二批读接口数据隔离闸门 (订单 / 我的组局 / 分
       expect(block).not.toContain('WHERE user_id = ? OR id = ?');
     });
 
+    it('订单归属不得把用户 id 当作大神档案 id 兜底（防 id 撞号越权）', () => {
+      expect(repoCode).not.toContain('user_id = ? OR id = ?');
+    });
+
     it('订单列表：管理端全量，普通用户仅本人相关', () => {
       const block = routeBlock("app.get('/api/orders',", 1800);
       expect(block).toContain('isVerifiedAdminRequest(req)');

server/tests/user-detail-scope.spec.ts

@@ -13,7 +13,9 @@ describe('第五十一批用户360画像关联闸门', () => {
     const start = repoCode.indexOf('async getUserDetail(');
     expect(start).toBeGreaterThan(-1);
     const block = repoCode.slice(start, start + 3000);
-    expect(block).toContain('OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)');
+    expect(block).toContain('OR expert_id IN (SELECT id FROM companions WHERE user_id = ?)');
+    expect(block).toContain('OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)');
+    expect(block).not.toContain('user_id = ? OR id = ?');
     expect(block).not.toContain('WHERE client_name = ? OR companion_name = ?');
   });