完善借款、编号、付款与预算并发及验收（09-06-release-gate-integrity）

汇总已落盘的借款本金与还款、兼容历史编号的周期化编号、付款责任与回单核验、报销进度和排序、PWA/采购事务、错误原因与日期校验及ERP退役。
统一共享预算池锁序和锁后判断，恢复差旅原预算选择，补原因码固定夹具及反向完整性检查。
纳入配套迁移、测试、受管QA、分层验收合同、规约及任务记录；原始证据留在ignored artifacts。

关联任务：09-17-company-loan-principal-repayment、09-17-erp-exclusive-retirement、09-18-reimbursement-periodic-numbering、09-08-reimbursement-payment-closeout、09-18-local-concurrency-product-fixes、09-19-budget-pool-concurrency、09-05-error-explainability-payment-readiness。
预算补审由Claude定向验证2文件928项通过，原4446/28及r6结果仍仅对应各自历史输入；本轮未重跑测试。
完整新候选门禁、R1真实入口接入与12项公网义务仍开放。生产编号未启用、差旅仍冻结；不推送、不部署，不宣称发布资格。

server/tests/unit/routes/users.sensitive-permissions.test.js

@@ -27,7 +27,9 @@ async function buildApp(permissionCodes) {
   });
   const employeeUpdate = vi.fn(async ({ data }) => ({ id: EMPLOYEE_ID, ...data }));
   const auditCreate = vi.fn().mockResolvedValue({ id: "audit-1" });
+  const bankInstitutionFindFirst = vi.fn().mockResolvedValue(null);
   const transaction = vi.fn(async (callback) => callback({
+    bankInstitution: { findFirst: bankInstitutionFindFirst },
     employee: {
       findUnique: employeeFindUnique,
       update: employeeUpdate,
@@ -70,7 +72,7 @@ async function buildApp(permissionCodes) {
   }));
 
   await app.register(usersRoutes, { prefix: "/api" });
-  return { app, auditCreate, employeeFindUnique, employeeUpdate, transaction };
+  return { app, auditCreate, employeeFindUnique, employeeUpdate, transaction, bankInstitutionFindFirst };
 }
 
 describe("user sensitive field permissions", () => {
@@ -194,3 +196,21 @@ describe("user sensitive field permissions", () => {
     await testApp.app.close();
   });
 });
+
+it.each([
+  ["PATCH", "/sensitive", { bankAccount: "invalid" }, 400, "user.sensitive_input_invalid", null],
+  ["PATCH", "/sensitive", {}, 400, "user.sensitive_update_empty", { body: "empty" }],
+  ["POST", "/sensitive/bank/reveal", { reason: "x" }, 400, "user.bank_reveal_input_invalid", null],
+  ["PATCH", "/sensitive", { bankInstitutionId: DEPARTMENT_ID }, 409, "user.bank_institution_unavailable", { bankInstitutionId: "not_available" }],
+])("explains %s %s without sensitive writes or successful audit", async (method, suffix, payload, status, reasonCode, details) => {
+  const t = await buildApp(["*"]);
+  try {
+    const response = await t.app.inject({ method, url: `/api/users/${EMPLOYEE_ID}${suffix}`, payload });
+    expect(response.statusCode).toBe(status); expect(response.json().error).toMatchObject({ code: "VALID_001", details: { reasonCode } });
+    if (details) expect(response.json().error.details).toEqual({ ...details, reasonCode });
+    else expect(response.json().error.details).toMatchObject({ formErrors: [], fieldErrors: expect.any(Object) });
+    expect(t.employeeUpdate).not.toHaveBeenCalled(); expect(t.auditCreate).not.toHaveBeenCalled();
+    if (status === 400) { expect(t.employeeFindUnique).not.toHaveBeenCalled(); expect(t.transaction).not.toHaveBeenCalled(); }
+    else expect(t.bankInstitutionFindFirst).toHaveBeenCalledTimes(1);
+  } finally { await t.app.close(); }
+});