fix: align permission navigation and page access

apps/server/src/expenses/expenses.service.ts

@@ -22,6 +22,21 @@ export class ExpensesService {
     @InjectRepository(Student) private studentRepo: Repository<Student>,
   ) {}
 
+  async getFormLookups() {
+    const [rooms, students] = await Promise.all([
+      this.roomRepo.find({
+        select: ['id', 'roomNumber', 'building'],
+        order: { building: 'ASC', roomNumber: 'ASC' },
+      }),
+      this.studentRepo.find({
+        select: ['id', 'name', 'studentNo'],
+        where: { status: 'active' },
+        order: { name: 'ASC' },
+      }),
+    ]);
+    return { rooms, students };
+  }
+
   // 宿舍费用
   async createRoomExpense(dto: CreateRoomExpenseDto, userId?: number) {
     const room = await this.roomRepo.findOne({ where: { id: dto.roomId } });