fix(admin): restore product visibility and code copying

frontend/src/components/admin/codes-resource.tsx

@@ -273,7 +273,10 @@ export default function CodesPage() {
           关闭后无法再次查看完整兑换码，请立即安全保存。
         </Typography.Paragraph>
         {generated.map((record) => (
-          <Typography.Paragraph copyable key={record.code}>
+          <Typography.Paragraph
+            copyable={{ text: record.code ?? "" }}
+            key={record.code}
+          >
             <Typography.Text code>{record.code}</Typography.Text>
           </Typography.Paragraph>
         ))}

frontend/supabase/migrations/20260817010000_billing_catalog_admin_runtime_read_policies.sql

@@ -0,0 +1,20 @@
+begin;
+
+do $$
+begin
+  if exists (select 1 from pg_roles where rolname = 'admin_runtime') then
+    grant select on table public.billing_products, public.product_entitlements
+      to admin_runtime;
+
+    drop policy if exists billing_products_admin_select on public.billing_products;
+    create policy billing_products_admin_select on public.billing_products
+      for select to admin_runtime using (true);
+
+    drop policy if exists product_entitlements_admin_select on public.product_entitlements;
+    create policy product_entitlements_admin_select on public.product_entitlements
+      for select to admin_runtime using (true);
+  end if;
+end;
+$$;
+
+commit;

frontend/tests/database-billing-admin.test.ts

@@ -162,6 +162,24 @@ test("billing, subscriptions, usage authorization, RBAC, and model publication r
     assert.equal(sql("select pg_has_role('admin_runtime','service_role','MEMBER')"), "f");
     assert.equal(sql("select has_function_privilege('admin_runtime','public.admin_permission_keys(uuid)','execute')"), "t");
     assert.equal(sql("select has_column_privilege('admin_runtime','public.profiles','birth_date','select')"), "f");
+    assert.equal(
+      fixture.psqlAs(
+        "admin_runtime",
+        "admin-runtime-test-password",
+        "select name from public.billing_products where code='standard_monthly'",
+      ),
+      "标准月卡",
+      "admin product lists must not be hidden by billing_products RLS",
+    );
+    assert.equal(
+      fixture.psqlAs(
+        "admin_runtime",
+        "admin-runtime-test-password",
+        "select count(*) from public.product_entitlements where product_id='00000000-0000-4000-8000-000000000902'",
+      ),
+      "3",
+      "admin product details must not be hidden by product_entitlements RLS",
+    );
     expectAdminRuntimeError("set role service_role", /permission denied to set role/);
     expectSqlError(
       `select * from public.admin_manage_role('${ids.owner}','${ids.owner}','owner',false,'不得移除最后 Owner','last-owner')`,

frontend/tests/high-risk-billing-routes-contract.test.ts

@@ -119,6 +119,7 @@ test("redemption-code writes generate server audit reasons and encode JSONB for
   assert.match(codesUi, /onFinish=\{\(values\) => void submitEdit\(values\)\}/);
   assert.match(codesUi, /onClick=\{\(\) => void revoke\(record\)\}/);
   assert.doesNotMatch(codesUi, /ConfirmActionModal|pendingCreate|pendingEdit|revokeRecord/);
+  assert.match(codesUi, /copyable=\{\{ text: record\.code \?\? "" \}\}/);
   assert.equal((redemptionAccessMigration.match(/admin_has_permission\(p_actor_user_id,'admin\.access'\)/g) ?? []).length, 3);
   assert.match(redemptionAccessMigration, /new\.permission_used := 'admin\.access'/);
   assert.match(baseRedemptionMigration, /admin_verified_actor_email/);