feat(server): P5 基础能力补齐（组织/报销/代办/认证安全）

- 组织/人员/委派对齐：费用类型、部门、员工别名、配置只读与回归脚本（F2/F3/F26/F27/F29/F31/F40）

- 报销单 PATCH/DELETE 与 items CRUD（事务内重算 total_amount）（F4/F5）

- 行政代提交/代上传后端校验与审计（F7/F8）

- 认证安全基线：首次登录改密、失败锁定、弱密码拦截与回归脚本（F36/F37/F39/F41）

server/src/scripts/seed-dev.js

@@ -57,6 +57,7 @@ async function ensureEmployee(prisma, payload) {
         bank_account_encrypted: "ENC_DEV_ONLY",
         bank_name: "DEV_BANK",
         password_hash: passwordHash,
+        must_change_password: false,
         updated_at: now,
       },
       select: { id: true, email: true },
@@ -92,6 +93,7 @@ async function ensureEmployee(prisma, payload) {
       bank_account_encrypted: "ENC_DEV_ONLY",
       bank_name: "DEV_BANK",
       password_hash: passwordHash,
+      must_change_password: false,
       created_at: now,
       updated_at: now,
     },

server/src/scripts/seed-trialrun.js

@@ -108,6 +108,7 @@ async function ensureAdminEmployee(prisma, params) {
       bank_account_encrypted: "ENC_TRIALRUN",
       bank_name: "TRIALRUN_BANK",
       password_hash: passwordHash,
+      must_change_password: true,
       created_at: now,
       created_by: null,
       updated_at: now,
@@ -178,4 +179,3 @@ main().catch((error) => {
   console.error(error);
   process.exit(1);
 });
-