fix: Fail-Closed 字段级安全加固 — 堵住15+端点价格泄露

## stock.py
- _make_price_stripper(): 工厂函数,选单前缀自动剥离所有价格/成本字段
- _do_get_stock_list(permission_prefix): 每个item.to_dict()后剥离价格
- /all 端点: 非AI模式自动剥离价格字段
- /list 端点: permission_prefix='outbound_selection' 传递

## outbound.py
- /bom-match-stock: 返回前按stock_type剥离全部价格/成本字段
- /scan: result.pop('price', None)

## scrap.py
- /scan: result.pop('price', None)
- /records: 每条记录剥离 cost_at_scrap, total_loss

## transactions.py
- filter_item_by_permissions: 从空字典恢复完整20字段映射
- /borrow/stock-list: permission_prefix='op_borrow_apply' 传递

## buy.py / semi.py / product.py
- submit 成功响应剥离所有价格/成本字段(不泄露给前端)

## bom.py
- /base/list: 剥离 referencePrice

inventory-backend/app/api/v1/bom.py

@@ -370,9 +370,14 @@ def get_material_base_list():
             page=page, per_page=limit, error_out=False
         )
 
-        # 构建返回数据
+        # 构建返回数据 — ★ Fail-Closed: 剥离 referencePrice
+        items = []
+        for item in pagination.items:
+            d = item.to_dict()
+            d.pop('referencePrice', None)
+            items.append(d)
         data = {
-            'list': [item.to_dict() for item in pagination.items],
+            'list': items,
             'total': pagination.total
         }