feat(server): 敏感字段加密与脱敏（F25）

- 新增敏感字段加密服务（AES-256-GCM，FIELD_ENCRYPTION_KEY）
- users 详情返回银行卡/身份证脱敏字段；新增 /users/:id/sensitive 特权明文接口并写审计
- 权限新增 system.users_sensitive（hr/admin）
- 更新 env/README 与 v3 CSV 状态推进

deploy/trialrun/docker-compose.yml

@@ -63,6 +63,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -118,6 +119,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -161,6 +163,7 @@ services:
       METRICS_ENABLED: ${METRICS_ENABLED}
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
+      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}