完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/users.list.test.js

@@ -62,6 +62,15 @@ async function buildApp({ routeOptions = {}, employee } = {}) {
   });
   app.decorate("config", {});
 
+  app.setErrorHandler((error, request, reply) => {
+    if (error instanceof AppError) {
+      return reply.status(error.statusCode).send({
+        error: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) },
+      });
+    }
+    return reply.status(500).send({ error: { code: "SYS_001" } });
+  });
+
   await app.register(usersRoutes, { prefix: "/api", ...routeOptions });
   return { app, findMany, count };
 }
@@ -269,3 +278,55 @@ describe("usersRoutes list query", () => {
     await app.close();
   });
 });
+
+
+describe("employee directory calendar filters", () => {
+  const routes = ["/users", "/employees"];
+  it.each(routes.flatMap((route) => ["hireDateFrom", "hireDateTo"].flatMap((field) => ["2026-02-29", "2026-04-31", "2026-13-01", ""].map((date) => [route, field, date]))))("rejects %s %s=%s before employee queries", async (route, field, date) => {
+    const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route, allowDepartmentFilter: route === "/employees" } });
+    try {
+      const response = await app.inject({ method: "GET", url: `/api${route}?${field}=${date}` });
+      expect(response.statusCode).toBe(400);
+      expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode: "employee_directory.query_invalid", formErrors: [], fieldErrors: { [field]: expect.arrayContaining(["invalid_calendar_date"]) } } });
+      expect(findMany).not.toHaveBeenCalled();
+      expect(count).not.toHaveBeenCalled();
+    } finally { await app.close(); }
+  });
+  it.each(routes)("preserves leap-day/month-end UTC range on %s", async (route) => {
+    const { app, findMany } = await buildApp({ routeOptions: { basePath: route } });
+    try {
+      const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-02-29&hireDateTo=2024-04-30` });
+      expect(response.statusCode).toBe(200);
+      expect(findMany.mock.calls[0][0].where.hire_date).toEqual({ gte: new Date("2024-02-29T00:00:00.000Z"), lte: new Date("2024-04-30T23:59:59.999Z") });
+    } finally { await app.close(); }
+  });
+  it.each(routes)("keeps reversed-range rejection on %s", async (route) => {
+    const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route } });
+    try {
+      const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-05-01&hireDateTo=2024-04-30` });
+      expect(response.statusCode).toBe(400);
+      expect(response.json().error.details).toEqual({ reasonCode: "employee_directory.hire_date_range_invalid", hireDateTo: "must_be_after_or_equal_hireDateFrom" });
+      expect(findMany).not.toHaveBeenCalled();
+      expect(count).not.toHaveBeenCalled();
+    } finally { await app.close(); }
+  });
+  it.each(routes)("does not grant access with valid dates on %s", async (route) => {
+    const { app, findMany, count } = await buildApp({ routeOptions: { basePath: route }, employee: { id: "synthetic-denied", permissionCodes: [] } });
+    try {
+      const response = await app.inject({ method: "GET", url: `/api${route}?hireDateFrom=2024-02-29` });
+      expect(response.statusCode).toBe(403);
+      expect(findMany).not.toHaveBeenCalled();
+      expect(count).not.toHaveBeenCalled();
+    } finally { await app.close(); }
+  });
+});
+
+it.each(["/users", "/employees"])("explains invalid pagination for %s before queries", async (basePath) => {
+  const { app, findMany, count } = await buildApp({ routeOptions: { basePath, allowDepartmentFilter: true } });
+  try {
+    const response = await app.inject({ method: "GET", url: `/api${basePath}?page=0` });
+    expect(response.statusCode).toBe(400);
+    expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode: "user.list_query_invalid", formErrors: [], fieldErrors: { page: expect.any(Array) } } });
+    expect(findMany).not.toHaveBeenCalled(); expect(count).not.toHaveBeenCalled();
+  } finally { await app.close(); }
+});