feat(server): 完成 P0+P1 后端能力（工作流、RBAC、付款归档）

P0 MVP：

- 认证：login/refresh/logout/forgot/reset + tokenVersion

- RBAC：角色到权限映射 + requirePermission

- 发票池：upload/bind/signed-url + 判重（VALID_003/VALID_005）

- 报销：create/view/submit + 单号生成

- 工作流：approve + department_manager 解析

P1 扩展：

- 动作：reject/return/withdraw（含 comment）

- transfer：任务转审 + 链路上限 3

- pay：approved -> paid + 发票归档 used_complete

- 动态审批链：approval_rules 驱动

回归脚本：

- smoke-test.sh / regression-dedup.sh / regression-workflow-actions.sh

server/postman/hyb-oa.postman_environment.json

@@ -0,0 +1,24 @@
+{
+  "id": "6d11aa57-5444-4cc2-b9ff-b8dcfa5d44ee",
+  "name": "hyb-oa local",
+  "values": [
+    { "key": "baseUrl", "value": "http://localhost:3000", "type": "default", "enabled": true },
+    { "key": "deviceFingerprint", "value": "dev-local-fingerprint", "type": "default", "enabled": true },
+    { "key": "sampleInvoiceFile", "value": "/tmp/hyb-oa-sample-invoice.pdf", "type": "default", "enabled": true },
+
+    { "key": "employeeIdentifier", "value": "[email protected]", "type": "default", "enabled": true },
+    { "key": "employeePassword", "value": "EmployeePassword1234", "type": "secret", "enabled": true },
+    { "key": "ceoIdentifier", "value": "[email protected]", "type": "default", "enabled": true },
+    { "key": "ceoPassword", "value": "CeoPassword1234", "type": "secret", "enabled": true },
+
+    { "key": "employeeAccessToken", "value": "", "type": "default", "enabled": true },
+    { "key": "ceoAccessToken", "value": "", "type": "default", "enabled": true },
+    { "key": "reimbursementId", "value": "", "type": "default", "enabled": true },
+    { "key": "invoicePoolId", "value": "", "type": "default", "enabled": true },
+    { "key": "workflowTaskId", "value": "", "type": "default", "enabled": true },
+    { "key": "workflowInstanceId", "value": "", "type": "default", "enabled": true }
+  ],
+  "_postman_variable_scope": "environment",
+  "_postman_exported_at": "2026-02-06T00:00:00.000Z",
+  "_postman_exported_using": "Codex CLI"
+}