完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

client/tests/e2e/r92-mobile-invoice-usability.spec.ts

@@ -3,6 +3,9 @@ import { expect, test, type Page, type Route, type TestInfo } from "@playwright/
 import { ADMIN } from "./helpers/auth";
 import { TEST_IDS } from "./helpers/testIds";
 
+// Route mocks must own requests; an installed worker bypasses page.route.
+test.use({ serviceWorkers: "block" });
+
 function envelope(data: unknown) {
   return { requestId: "r92-mock", data };
 }
@@ -23,6 +26,7 @@ async function attachScreenshot(page: Page, testInfo: TestInfo, name: string) {
 }
 
 async function mockAuthenticatedShell(page: Page) {
+  let signedIn = false;
   await page.route((url) => url.pathname === "/api/auth/sso/providers", (route) => fulfillJson(route, []));
   await page.route((url) => url.pathname === "/api/auth/wecom/config", (route) =>
     fulfillJson(route, {
@@ -39,6 +43,7 @@ async function mockAuthenticatedShell(page: Page) {
     }),
   );
   await page.route((url) => url.pathname === "/api/auth/login", async (route) => {
+    signedIn = true;
     await route.fulfill({
       status: 200,
       contentType: "application/json",
@@ -50,13 +55,17 @@ async function mockAuthenticatedShell(page: Page) {
       })),
     });
   });
-  await page.route((url) => url.pathname === "/api/auth/refresh", (route) =>
-    fulfillJson(route, {
+  await page.route((url) => url.pathname === "/api/auth/refresh", async (route) => {
+    if (!signedIn) {
+      await route.fulfill({ status: 401, contentType: "application/json", body: JSON.stringify({ error: { code: "AUTH_001" } }) });
+      return;
+    }
+    await fulfillJson(route, {
       accessToken: "r92-access-token",
       expiresIn: 900,
       mustChangePassword: false,
-    }),
-  );
+    });
+  });
   await page.route((url) => url.pathname === "/api/me", (route) =>
     fulfillJson(route, {
       id: "employee-mock-1",