fix(doa): checkStageMemberPermission 空指针绕过同源修复

cfc-backend/src/main/java/com/etotem/cfc/service/DoaService.java

@@ -313,9 +313,10 @@ public class DoaService {
     /** 校验当前用户对该阶段的编辑权限（本人 或 代管不能登录成员） */
     private boolean checkStageMemberPermission(DoaStage stage, Long userId, Long familyId) {
         Long selfMemberId = resolveMemberIdByUserId(userId, familyId);
-        if (selfMemberId != null && selfMemberId.equals(stage.getMemberId())) return true;
+        boolean isSelf = selfMemberId != null && selfMemberId.equals(stage.getMemberId());
         FamilyMember target = familyMemberMapper.selectById(stage.getMemberId());
-        return target != null && target.getUserId() == null;
+        boolean canManageLocal = target != null && target.getUserId() == null;
+        return isSelf || canManageLocal;
     }
 
     /** userId → 家庭内成员ID */