feat(server): 敏感字段加密与脱敏（F25）

- 新增敏感字段加密服务（AES-256-GCM，FIELD_ENCRYPTION_KEY）
- users 详情返回银行卡/身份证脱敏字段；新增 /users/:id/sensitive 特权明文接口并写审计
- 权限新增 system.users_sensitive（hr/admin）
- 更新 env/README 与 v3 CSV 状态推进

deploy/trialrun/.env.example

@@ -11,6 +11,9 @@ APP_ORIGIN="http://127.0.0.1:3000"
 
 # ===== 服务端密钥（必须修改）=====
 JWT_SECRET="change_me_in_trialrun"
+# ===== 敏感字段加密（F25）=====
+# 生成方式示例：openssl rand -base64 32
+FIELD_ENCRYPTION_KEY=""
 
 # ===== 数据库（Compose 内部连接）=====
 POSTGRES_DB="hyb_oa"

deploy/trialrun/docker-compose.yml

@@ -63,6 +63,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -118,6 +119,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -161,6 +163,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}