feat(server): 票据增强闭环（F9/F10/F11/F12/F13/F28）

- /invoice-pool 新增 unbind、PATCH 修正、manual archive、OCR retry、判重例外 override（含 VALID_004/006/007）

- signed-url 签发/下载写入审计日志（脱敏 extra）

- 新增未绑定票据自动归档作业 + 一次性执行脚本

- 回归脚本增强：workflow-actions/dedup/audit/ocr 覆盖上述场景；v3 CSV 状态推进至 DONE

server/scripts/regression-workflow-actions.sh

@@ -1317,6 +1317,17 @@ if [[ "$RUN_PAY_CONCURRENCY_CHECK" == "1" ]]; then
   assert_invoices_archived_used_complete "$RID_PAY_CONCURRENCY" "pay concurrency"
 fi
 
+echo "[22.2/23] invoice unbind/rebind"
+RID_UNBIND_A="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/unbind-a-create.json")"
+INVOICE_UNBIND="$(create_and_bind_invoice "$EMPLOYEE_TOKEN" "$RID_UNBIND_A" "unbind")"
+unbind_status="$(api_json_auth POST "$BASE_URL/api/invoice-pool/$INVOICE_UNBIND/unbind" "$EMPLOYEE_TOKEN" "$TMP_DIR/unbind.json" '{}')"
+assert_status "$unbind_status" "200" "invoice unbind" "$TMP_DIR/unbind.json"
+assert_jq "$TMP_DIR/unbind.json" '.data.status == "available" and .data.linkedReimbursementId == null and .data.linkedItemId == null' "invoice unbind response"
+
+RID_UNBIND_B="$(create_reimbursement "$EMPLOYEE_TOKEN" "$TMP_DIR/unbind-b-create.json")"
+rebind_status="$(api_json_auth POST "$BASE_URL/api/invoice-pool/$INVOICE_UNBIND/bind" "$EMPLOYEE_TOKEN" "$TMP_DIR/unbind-rebind.json" "{\"reimbursementId\":\"$RID_UNBIND_B\"}")"
+assert_status "$rebind_status" "200" "invoice rebind after unbind" "$TMP_DIR/unbind-rebind.json"
+
 echo "[23/23] Final manager relation restore"
 set_employee_direct_manager "$EMPLOYEE_ID" "$ORIGINAL_EMPLOYEE_MANAGER_ID"
 EMPLOYEE_MANAGER_PATCHED=0