完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/src/routes/purchaseRequests.js

@@ -115,6 +115,12 @@ const PURCHASE_ATTACHMENT_DOWNLOAD_BODY_SCHEMA = z
   })
   .strict();
 
+const PURCHASE_ATTACHMENT_DELETE_BODY_SCHEMA = z
+  .object({
+    reason: z.string().trim().min(2).max(200),
+  })
+  .strict();
+
 const PURCHASE_SUMMARY_SELECT = {
   id: true,
   request_no: true,
@@ -1062,6 +1068,14 @@ function parsePurchaseAttachmentDownloadBody(body) {
   return parsed.data;
 }
 
+function parsePurchaseAttachmentDeleteBody(body) {
+  const parsed = PURCHASE_ATTACHMENT_DELETE_BODY_SCHEMA.safeParse(body ?? {});
+  if (!parsed.success) {
+    throw buildValidationError(parsed.error.flatten());
+  }
+  return parsed.data;
+}
+
 function buildAttachmentBlockedError(reasonCode, message = "附件未通过安全校验", statusCode = 409) {
   return new AppError({
     code: "VALID_001",
@@ -2521,6 +2535,7 @@ async function purchaseRequestRoutes(fastify, options = {}) {
     async (request, reply) => {
       const purchaseRequestId = parsePurchaseRequestId(request.params?.id);
       const attachmentId = parseAttachmentId(request.params?.attachmentId);
+      const { reason } = parsePurchaseAttachmentDeleteBody(request.body);
 
       const purchaseRequest = await fastify.prisma.purchaseRequest.findUnique({
         where: { id: purchaseRequestId },
@@ -2570,6 +2585,7 @@ async function purchaseRequestRoutes(fastify, options = {}) {
             targetId: attachmentId,
             extra: {
               purchaseRequestId,
+              reason,
             },
           }),
         });