[Membership] Make role DataScope the single source of truth for row-level access

[Copilot]

DataScope could not drive row-level permissions: Role.Valid rewrote "全部"(0) on every save, DataScopeInterceptor.OnValid swallowed access failures and returned true, and User/Department/Log were not wired into GetFilter. This makes the role DataScope field the authoritative row-permission source, which XCode must own since Cube cannot patch these across assemblies.

Validation (P0)

• 角色.Biz.cs — Default DataScope from Type only on Insert when the field is not dirty. On Update or explicit assignment, 0 means "全部" and is left untouched.
• DataScopeModule.cs — OnValid now returns false (after writing the audit log) when an access check throws, instead of returning true. No-context still skips validation.

Entity wiring (P0)

• User — register DataScopeInterceptor.
• Department — implement IDepartmentScope (DepartmentId→ID) + IDataScopeFieldProvider + interceptor.
• Log — implement IUserScope (→CreateUserID), GetUserField() => _.CreateUserID + interceptor.

Filter semantics (P1)

• Pure IDepartmentScope (one row per department): 仅本人 filters ID = current department instead of the always-false Equal(-1); other scopes reuse BuildDepartmentFilter. CanAccess(IDepartmentScope) mirrors this. IDataScope (User) 仅本人-by-UserId semantics are unchanged.
• Pure IUserScope (no department column, e.g. Log): non-全部 stays userField = currentUser, so 本部门/自定义 do not widen to colleagues' rows.

Cache (P1)

• DataScopeContext — cache key is now userId+deptId+scope so a department change takes effect immediately; ClearCache(userId) removes both old and new keys by prefix (best-effort).

Menu default (P2)

• 菜单.Biz.cs — new/unconfigured menus keep DataScope = -1 (use role default) rather than persisting 0 and overriding the role to "全部".

Example

// Log: no department column → 本部门 filters by creator, not colleagues
DataScopeContext.Current = new DataScopeContext
{
    UserId = 100, DepartmentId = 200,
    DataScope = DataScopes.本部门, AccessibleDepartmentIds = [200]
};
var filter = DataScopeHelper.GetFilter<Log>();   // CreateUserID = 100

// Department: 仅本人 → own department row, not an empty table
DataScopeContext.Current = new DataScopeContext { UserId = 100, DepartmentId = 200, DataScope = DataScopes.仅本人 };
var deptFilter = DataScopeHelper.GetFilter<Department>();   // ID = 200 (was ID = -1)

Adds 7 acceptance tests in DataScopeTests.cs covering the criteria above, and corrects one existing test that relied on the swallowed-exception behavior.

• Fixes [Membership] DataScope 无法作为行权事实源：Role.Valid 吞掉「全部」、DataScopeInterceptor 校验失败仍 return true、User/Department/Log 未挂载 #98