feat(server): 完成 P0+P1 后端能力（工作流、RBAC、付款归档）

P0 MVP：

- 认证：login/refresh/logout/forgot/reset + tokenVersion

- RBAC：角色到权限映射 + requirePermission

- 发票池：upload/bind/signed-url + 判重（VALID_003/VALID_005）

- 报销：create/view/submit + 单号生成

- 工作流：approve + department_manager 解析

P1 扩展：

- 动作：reject/return/withdraw（含 comment）

- transfer：任务转审 + 链路上限 3

- pay：approved -> paid + 发票归档 used_complete

- 动态审批链：approval_rules 驱动

回归脚本：

- smoke-test.sh / regression-dedup.sh / regression-workflow-actions.sh

docker-compose.yml

@@ -0,0 +1,42 @@
+version: '3.8'
+
+services:
+  db:
+    image: postgres:15-alpine
+    container_name: hyb-oa-db
+    restart: always
+    environment:
+      POSTGRES_USER: hyboa_user
+      POSTGRES_PASSWORD: hyboa_password
+      POSTGRES_DB: hyb_oa
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+
+  server:
+    image: node:20-alpine
+    container_name: hyb-oa-server
+    restart: unless-stopped
+    working_dir: /app/server
+    command: sh -c "npm install && npm run dev"
+    environment:
+      DATABASE_URL: "postgresql://hyboa_user:hyboa_password@db:5432/hyb_oa?schema=public"
+      JWT_SECRET: "change_me"
+      APP_TIMEZONE: "Asia/Shanghai"
+      STORAGE_DIR: "generated/storage"
+      SIGNED_URL_TTL_SECONDS: "600"
+      MAX_UPLOAD_SIZE_BYTES: "10485760"
+      PORT: "3000"
+      HOST: "0.0.0.0"
+    ports:
+      - "3000:3000"
+    depends_on:
+      - db
+    volumes:
+      - ./:/app
+      - server_storage:/app/server/generated/storage
+
+volumes:
+  postgres_data:
+  server_storage: