实现业务附件受控入库 V1（05-28-business-attachment-governance-v1）

server/prisma/schema.prisma

@@ -1183,14 +1183,28 @@ model PurchaseAttachment {
   original_name       String
   mime_type           String
   file_size           Int
+  file_sha256         String?
   uploaded_by         String   @db.Uuid
   created_at          DateTime @default(now())
+  governance_status   String   @default("approved") @db.VarChar(32)
+  sensitivity_level   String   @default("internal") @db.VarChar(32)
+  attachment_type     String   @default("other") @db.VarChar(64)
+  reviewed_by         String?  @db.Uuid
+  reviewed_at         DateTime?
+  review_note         String?
+  archived_by         String?  @db.Uuid
+  archived_at         DateTime?
+  archive_note        String?
+  download_policy     String   @default("standard") @db.VarChar(32)
 
   purchase_request PurchaseRequest @relation(fields: [purchase_request_id], references: [id], onDelete: Cascade)
   uploader         Employee        @relation("PurchaseAttachmentUploader", fields: [uploaded_by], references: [id], onDelete: Restrict)
 
   @@index([purchase_request_id, created_at], map: "idx_purchase_attachments_request_created")
   @@index([uploaded_by], map: "idx_purchase_attachments_uploader")
+  @@index([file_sha256], map: "idx_purchase_attachments_file_sha256")
+  @@index([governance_status], map: "idx_purchase_attachments_governance_status")
+  @@index([sensitivity_level], map: "idx_purchase_attachments_sensitivity_level")
   @@map("purchase_attachments")
 }
 
@@ -1446,6 +1460,16 @@ model ReimbursementAttachment {
   file_sha256      String
   uploaded_by      String   @db.Uuid
   created_at       DateTime @default(now())
+  governance_status String   @default("approved") @db.VarChar(32)
+  sensitivity_level String   @default("internal") @db.VarChar(32)
+  attachment_type   String   @default("supporting_material") @db.VarChar(64)
+  reviewed_by       String?  @db.Uuid
+  reviewed_at       DateTime?
+  review_note       String?
+  archived_by       String?  @db.Uuid
+  archived_at       DateTime?
+  archive_note      String?
+  download_policy   String   @default("standard") @db.VarChar(32)
 
   reimbursement_form ReimbursementForm @relation(fields: [reimbursement_id], references: [id], onDelete: Cascade)
   uploader           Employee          @relation("ReimbursementAttachmentUploader", fields: [uploaded_by], references: [id], onDelete: Restrict)
@@ -1453,6 +1477,8 @@ model ReimbursementAttachment {
   @@index([reimbursement_id, created_at], map: "idx_reimbursement_attachments_form_created")
   @@index([uploaded_by], map: "idx_reimbursement_attachments_uploader")
   @@index([file_sha256], map: "idx_reimbursement_attachments_file_sha256")
+  @@index([governance_status], map: "idx_reimbursement_attachments_governance_status")
+  @@index([sensitivity_level], map: "idx_reimbursement_attachments_sensitivity_level")
   @@map("reimbursement_attachments")
 }
 
@@ -1867,6 +1893,16 @@ model PaymentBatchReceiptAttachment {
   file_sha256      String
   uploaded_by      String   @db.Uuid
   created_at       DateTime @default(now())
+  governance_status String   @default("approved") @db.VarChar(32)
+  sensitivity_level String   @default("confidential") @db.VarChar(32)
+  attachment_type   String   @default("receipt") @db.VarChar(64)
+  reviewed_by       String?  @db.Uuid
+  reviewed_at       DateTime?
+  review_note       String?
+  archived_by       String?  @db.Uuid
+  archived_at       DateTime?
+  archive_note      String?
+  download_policy   String   @default("reason_required") @db.VarChar(32)
 
   payment_batch PaymentBatch @relation(fields: [payment_batch_id], references: [id], onDelete: Cascade)
   uploader      Employee     @relation("PaymentBatchReceiptAttachmentUploader", fields: [uploaded_by], references: [id], onDelete: Restrict)
@@ -1874,6 +1910,8 @@ model PaymentBatchReceiptAttachment {
   @@index([payment_batch_id, created_at], map: "idx_payment_batch_receipts_batch_created")
   @@index([uploaded_by], map: "idx_payment_batch_receipts_uploader")
   @@index([file_sha256], map: "idx_payment_batch_receipts_file_sha256")
+  @@index([governance_status], map: "idx_payment_batch_receipts_governance_status")
+  @@index([sensitivity_level], map: "idx_payment_batch_receipts_sensitivity_level")
   @@map("payment_batch_receipt_attachments")
 }