借款出借人改为从现有员工选择并复用资料（09-17-company-loan-principal-repayment）

- 新增员工来源预览、关联与显式刷新接口，受 loan.manage 与员工银行卡权限保护；服务端读取并加密保存，客户端不能另传姓名账号
- 同公司同员工唯一复用，请求键绑定来源；锁序出借人→员工，员工使用 FOR NO KEY UPDATE
- 员工关联出借人禁止手工改账号；在途还款期间禁止刷新，刷新推进版本并使旧公司代表授权失效
- 电脑/手机共用对话框，写请求在卸载或身份切换时取消
- 无新增迁移；本地 126 组 HTTP、45 组浏览器、9 个变异通过，两名只读复核及 Claude 独立复核无阻断

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/qa/company-loan-browser.cjs

@@ -6,7 +6,7 @@ const root = path.resolve(__dirname, '../..');
 const req = createRequire(path.join(root, 'client/package.json'));
 const { chromium, expect } = req('@playwright/test');
 
-module.exports = async function runBrowser({ app, finance, manager, ordinary, password, company, bank, prisma, attributionUi, reconciliationUi, config, relatedParty }) {
+module.exports = async function runBrowser({ app, finance, manager, ordinary, password, company, bank, prisma, attributionUi, reconciliationUi, config, relatedParty, employeeSources }) {
   const output = mkdtempSync(path.join(root, 'artifacts/qa-layout/payment-feedback-loan-slim-20260917/browser-'));
   const origin = await app.listen({ host: '127.0.0.1', port: 0 });
   const browser = await chromium.launch({ headless: true, args: ['--disable-background-networking'] });
@@ -39,6 +39,7 @@ module.exports = async function runBrowser({ app, finance, manager, ordinary, pa
       await expect(page.getByRole('heading', { name: '公司借款', exact: true })).toBeVisible();
       await page.getByRole('button', { name: '登记出借人', exact: true }).click();
       let dialog = page.getByRole('dialog');
+      await dialog.getByRole('button', { name: '登记非员工出借人', exact: true }).click();
       await dialog.getByLabel('公司主体').selectOption(company.id);
       const lenderName = `合成浏览器出借人-${mode}`;
       await dialog.getByLabel('出借人姓名').fill(lenderName);
@@ -301,6 +302,7 @@ module.exports = async function runBrowser({ app, finance, manager, ordinary, pa
       browser, origin, output, finance, manager, password, prisma, fixtures: reconciliationUi,
     }));
     if (relatedParty) checks.push(...await require('./company-loan-related-browser.cjs')({ browser, origin, output, finance, manager, ordinary, password, prisma, config, relatedParty }));
+    if (employeeSources) checks.push(...await require('./company-loan-employee-browser.cjs')({ browser, origin, output, finance, password, prisma, config, employeeSources }));
     const context = await browser.newContext({ serviceWorkers: 'block' });
     await context.route('**/*', route => route.request().url().startsWith(`${origin}/`) ? route.continue() : route.abort());
     const page = await context.newPage();