feat(client): 用户管理页 + E2E 门禁（E15/E16/E18）

- 新增系统用户管理页（创建/禁用启用/重置密码/角色）

- 引入 Playwright E2E：覆盖登录-报销-待办-票据-OCR-支付-登出

- 新增 ci-e2e 工作流（PR + nightly）

.github/workflows/ci-e2e.yml

@@ -0,0 +1,122 @@
+name: ci-e2e
+
+on:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "10 19 * * *"
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: hyb_oa
+          POSTGRES_USER: hyboa_user
+          POSTGRES_PASSWORD: hyboa_password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U hyboa_user -d hyb_oa"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+
+    env:
+      NODE_ENV: test
+      PORT: 3000
+      HOST: 127.0.0.1
+      APP_ORIGIN: http://127.0.0.1:3000
+      DATABASE_URL: postgresql://hyboa_user:[email protected]:5432/hyb_oa?schema=public
+      JWT_SECRET: ci_e2e_secret_key
+      OCR_PROVIDER: mock
+      OCR_MAX_ATTEMPTS: 3
+      OCR_POLL_CRON: "*/5 * * * * *"
+      DELEGATION_REVOKE_CRON: "0 * * * *"
+      SERVE_CLIENT_DIST: "true"
+      CLIENT_DIST_DIR: "../client/dist"
+      E2E_BASE_URL: http://127.0.0.1:3000
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: |
+            server/package-lock.json
+            client/package-lock.json
+
+      - name: Install server dependencies
+        working-directory: server
+        run: npm ci
+
+      - name: Install client dependencies
+        working-directory: client
+        run: npm ci
+
+      - name: Migrate database
+        working-directory: server
+        run: npm run prisma:migrate:deploy
+
+      - name: Seed database
+        working-directory: server
+        run: npm run seed:dev
+
+      - name: Build client
+        working-directory: client
+        run: npm run build
+
+      - name: Install Playwright browsers
+        working-directory: client
+        run: npx playwright install --with-deps
+
+      - name: Start server
+        working-directory: server
+        run: |
+          nohup npm run dev > /tmp/hyb-oa-server.log 2>&1 &
+          echo $! > /tmp/hyb-oa-server.pid
+
+      - name: Wait for ready
+        run: |
+          for i in {1..45}; do
+            if curl -fsS "http://127.0.0.1:3000/ready" >/dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Server readiness check timed out" >&2
+          exit 1
+
+      - name: Run Playwright E2E
+        working-directory: client
+        run: npm run test:e2e
+
+      - name: Stop server
+        if: always()
+        run: |
+          if [[ -f /tmp/hyb-oa-server.pid ]]; then
+            kill "$(cat /tmp/hyb-oa-server.pid)" || true
+          fi
+
+      - name: Dump server log on failure
+        if: failure()
+        run: |
+          echo "==== /tmp/hyb-oa-server.log ===="
+          cat /tmp/hyb-oa-server.log || true
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: client/playwright-report
+          if-no-files-found: ignore
+