fix: prevent self-review of OKR and add top-level auto-approve to hierarchy submit

backend/src/main/java/com/yimeng/okr/service/OkrService.java

@@ -172,8 +172,13 @@ public class OkrService {
         obj.setSortOrder(0);
         obj.setProgress(0.0);
         obj.setVersion(1);
-        obj.setStatus("INDIVIDUAL".equals(level) ? "SUBMITTED" : "APPROVED");
-        if (!"INDIVIDUAL".equals(level)) {
+        boolean isTopLevel = user.getSuperiorId() == null || user.getSuperiorId() <= 0;
+        if ("INDIVIDUAL".equals(level)) {
+            obj.setStatus(isTopLevel ? "APPROVED" : "SUBMITTED");
+        } else {
+            obj.setStatus("APPROVED");
+        }
+        if (!"INDIVIDUAL".equals(level) || isTopLevel) {
             obj.setReviewedBy(userId);
             obj.setReviewedAt(LocalDateTime.now());
         }
@@ -242,9 +247,12 @@ public class OkrService {
             throw new BusinessException("该OKR不在待审核状态");
         }
 
-        // Permission: reviewer must be the OKR owner's superior or dept leader
+        // Permission: reviewer must be the OKR owner's superior, or dept leader (but not self)
         SysUser owner = userMapper.selectById(obj.getUserId());
         if (owner == null) throw new BusinessException(404, "OKR属主不存在");
+        if (reviewerId.equals(obj.getUserId())) {
+            throw new BusinessException("不能审核自己的OKR");
+        }
         boolean isSuperior = reviewerId.equals(owner.getSuperiorId());
         boolean isDeptLeader = false;
         if (owner.getDepartmentId() != null) {