feat: 完成 F17 报表导出（CSV/XLSX）\n\n- 后端新增 /api/exports/* 导出接口（含权限与审计记录）\n- CSV 采用流式生成，XLSX 使用 exceljs\n- 前端在报销/票据/审计页加入导出入口（下载 Blob）\n- 更新 P5 蓝图 v3 中 F17 状态为 DONE

issues/2026-02-09_13-39-02-p5-blueprint-v3.csv

@@ -15,7 +15,7 @@ F13,signed-url审计与下载行为记录,"对 signed-url 签发与下载两类
 F14,站内通知基础设施（DB+API）,"新增 notifications 表与 API（list/markRead），用于工作流与系统事件通知","可分页读取；可标记已读；权限隔离正确；最小索引满足试运行","cd server && npm run prisma:migrate:dev && ./scripts/regression-all.sh",manual,DONE,DONE,DONE,"server/prisma/schema.prisma | server/src/routes/notifications.js | server/src/app.js","[""F1""]","只做最小字段：title/body/type/targetId/readAt"
 F15,邮件通知（SMTP/Nodemailer）,"引入 nodemailer 发送邮件：新待办/审批结果/付款完成/密码重置等；失败降级不阻塞主流程；可配置开关","EMAIL_ENABLED=false 时不发送；开启后可发出测试邮件；失败仅记录 audit/日志不影响业务","manual: 配置 SMTP 并触发一次待办通知/重置密码邮件",manual,DONE,DONE,DONE,"server/src/services/email/* | server/src/config.js | server/src/routes/auth.js | server/src/routes/reimbursements.js | server/src/routes/workflow.js | server/package.json | server/README.md","[""F14""]","优先复用成熟 nodemailer；写回滚说明"
 F16,前端通知入口（Bell）,"新增通知列表页/弹层与未读角标；支持标记已读","四角色均可见自己的通知；读写后角标正确；e2e 覆盖核心路径","cd client && npm run test:e2e",manual,DONE,DONE,DONE,"client/src/components/navigation/Topbar.tsx | client/src/pages/NotificationsPage.tsx | client/src/api/notifications.ts","[""F14""]","保持 UI 轻量，不做复杂订阅推送"
-F17,报表导出（CSV/Excel）,"新增报销/票据/审计的导出接口（权限控制），前端提供下载入口","导出字段与权限正确；大数据量时可分页/流式输出；审计记录导出操作","manual: 导出后核对字段；并在 audit_logs 中检索 EXPORT 动作",manual,TODO,TODO,TODO,"server/src/routes/exports.js | client/src/pages/* | server/package.json","[""F6"",""F16""]","推荐 exceljs 或 csv-stringify（二选一并写 Notes：用途/版本/回滚）"
+F17,报表导出（CSV/Excel）,"新增报销/票据/审计的导出接口（权限控制），前端提供下载入口","导出字段与权限正确；大数据量时可分页/流式输出；审计记录导出操作","manual: 导出后核对字段；并在 audit_logs 中检索 EXPORT 动作",manual,DONE,DONE,DONE,"server/src/routes/exports.js | server/src/app.js | server/package.json | server/package-lock.json | client/src/api/exports.ts | client/src/api/http.ts | client/src/lib/download.ts | client/src/pages/ReimbursementsPage.tsx | client/src/pages/InvoicePoolPage.tsx | client/src/pages/AuditLogsPage.tsx","[""F6"",""F16""]","选型：exceljs（XLSX），CSV 采用流式生成；回滚：删除 exportsRoutes 注册与依赖即可"
 F18,审批规则维护（system.settings）,"补齐 approval_rules 维护 API 与最小前端页（finance_mgr/admin），支持启停与优先级/金额段维护","规则变更可立即影响新 submit；历史 instance 不回写；审计记录变更","cd server && ./scripts/regression-workflow-actions.sh",manual,DONE,DONE,DONE,"server/src/routes/approvalRules.js | server/src/app.js | client/src/pages/ApprovalRulesPage.tsx | client/src/api/approvalRules.ts | client/src/router/index.tsx | client/src/components/navigation/NavLinks.tsx","[""F5""]","只做最小可运营；复杂可视化后置"
 F19,作业系统升级（pg-boss 基础设施）,"引入 pg-boss（Postgres 队列）作为作业基础设施：提供统一注册/执行框架与开关；保持 node-cron 作业可回滚；并文档化单机用法","pg-boss 可在单机/多进程下可靠运行；最小示例 job 可跑通；不影响现有回归","cd server && ./scripts/regression-all.sh",manual,TODO,TODO,TODO,"server/src/jobs/* | server/src/app.js | server/package.json | deploy/trialrun/* | server/README.md","[""F1""]","选择 pg-boss（成熟/无 Redis）；回滚：关闭开关并切回 node-cron"
 F19b,作业迁移（OCR -> pg-boss）,"将 OCR 异步处理迁移到 pg-boss：保持并发锁语义、幂等与回归脚本不变","mock/tencent 两种 provider 下 OCR 仍可跑；并发下单条仅处理一次；回归全绿","cd server && ./scripts/regression-ocr.sh && ./scripts/regression-all.sh",manual,TODO,TODO,TODO,"server/src/jobs/ocrJob.js | server/src/services/ocr/* | server/README.md","[""F19""]","迁移后移除/停用对应 node-cron tick（保留回滚路径）"