fix: align permission navigation and page access

apps/server/src/deposits/deposits.lookups.spec.ts

@@ -0,0 +1,15 @@
+import { DepositsService } from './deposits.service';
+
+describe('DepositsService permission-scoped lookups', () => {
+  it('returns only minimal student fields needed by deposit forms', async () => {
+    const studentRepo = {
+      find: jest.fn().mockResolvedValue([{ id: 2, name: '张三', studentNo: 'S2' }]),
+    };
+    const service = new DepositsService({} as never, {} as never, studentRepo as never);
+
+    await expect(service.getStudentLookups()).resolves.toEqual([
+      { id: 2, name: '张三', studentNo: 'S2' },
+    ]);
+    expect(studentRepo.find).toHaveBeenCalledWith(expect.objectContaining({ select: ['id', 'name', 'studentNo'] }));
+  });
+});