完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/prisma/migrations/20260718120000_add_system_admin_role/migration.sql

@@ -0,0 +1,2 @@
+-- Add the restricted OA operator role without changing any existing account.
+ALTER TYPE "RoleCode" ADD VALUE IF NOT EXISTS 'system_admin' BEFORE 'admin';

server/prisma/migrations/20260718123000_small_team_payment_cancel_reason/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "payment_batches"
+    ADD COLUMN "cancelled_reason" TEXT;

server/prisma/schema.prisma

@@ -14,6 +14,7 @@ enum RoleCode {
   finance_mgr
   administration
   hr
+  system_admin
   admin
 }
 
@@ -1862,6 +1863,7 @@ model PaymentBatch {
   executed_by           String?   @db.Uuid
   cancelled_at          DateTime?
   cancelled_by          String?   @db.Uuid
+  cancelled_reason      String?
   updated_at            DateTime  @updatedAt
   updated_by            String?   @db.Uuid