feat(server): 完成 P3 后端API与回归（D2~D9）

- workflow: 任务详情/转审候选/列表分页字段（D5）
- reimbursements: 列表API + pay凭证字段/幂等增强（D7）
- invoice-pool: 列表/详情API + 上传pending_ocr（D9）
- ocr/audit: mock provider + 回归脚本 + regression-all开关（D2/D3）
- CI: 新增 ci-minimal / ci-regression 工作流（D4）

.github/workflows/ci-minimal.yml

@@ -0,0 +1,37 @@
+name: ci-minimal
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check-minimal:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: |
+            server/package-lock.json
+            client/package-lock.json
+
+      - name: Install server dependencies
+        working-directory: server
+        run: npm ci
+
+      - name: Install client dependencies
+        working-directory: client
+        run: npm ci
+
+      - name: Run minimal checks
+        run: ./scripts/check-minimal.sh

.github/workflows/ci-regression.yml

@@ -0,0 +1,95 @@
+name: ci-regression
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 18 * * *"
+
+jobs:
+  server-regression:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: hyb_oa
+          POSTGRES_USER: hyboa_user
+          POSTGRES_PASSWORD: hyboa_password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U hyboa_user -d hyb_oa"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+
+    env:
+      NODE_ENV: test
+      PORT: 3000
+      HOST: 127.0.0.1
+      APP_ORIGIN: http://127.0.0.1:5173
+      DATABASE_URL: postgresql://hyboa_user:[email protected]:5432/hyb_oa?schema=public
+      JWT_SECRET: ci_regression_secret_key
+      OCR_PROVIDER: mock
+      OCR_MAX_ATTEMPTS: 3
+      DELEGATION_REVOKE_CRON: "0 * * * *"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: server/package-lock.json
+
+      - name: Install server dependencies
+        working-directory: server
+        run: npm ci
+
+      - name: Migrate database
+        working-directory: server
+        run: npm run prisma:migrate:deploy
+
+      - name: Seed database
+        working-directory: server
+        run: npm run seed:dev
+
+      - name: Start server
+        working-directory: server
+        run: |
+          nohup npm run dev > /tmp/hyb-oa-server.log 2>&1 &
+          echo $! > /tmp/hyb-oa-server.pid
+
+      - name: Wait for health
+        run: |
+          for i in {1..30}; do
+            if curl -fsS "http://127.0.0.1:3000/health" >/dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Server health check timed out" >&2
+          exit 1
+
+      - name: Run full regression suite
+        working-directory: server
+        run: |
+          RUN_AUDIT_REGRESSION=1 RUN_OCR_REGRESSION=1 ./scripts/regression-all.sh
+
+      - name: Stop server
+        if: always()
+        run: |
+          if [[ -f /tmp/hyb-oa-server.pid ]]; then
+            kill "$(cat /tmp/hyb-oa-server.pid)" || true
+          fi
+
+      - name: Dump server log on failure
+        if: failure()
+        run: |
+          echo "==== /tmp/hyb-oa-server.log ===="
+          cat /tmp/hyb-oa-server.log || true