feat(server): 完成 P0+P1 后端能力（工作流、RBAC、付款归档）

P0 MVP：

- 认证：login/refresh/logout/forgot/reset + tokenVersion

- RBAC：角色到权限映射 + requirePermission

- 发票池：upload/bind/signed-url + 判重（VALID_003/VALID_005）

- 报销：create/view/submit + 单号生成

- 工作流：approve + department_manager 解析

P1 扩展：

- 动作：reject/return/withdraw（含 comment）

- transfer：任务转审 + 链路上限 3

- pay：approved -> paid + 发票归档 used_complete

- 动态审批链：approval_rules 驱动

回归脚本：

- smoke-test.sh / regression-dedup.sh / regression-workflow-actions.sh

server/prisma/migrations/20260206071653_password_reset_codes/migration.sql

@@ -0,0 +1,22 @@
+-- CreateTable
+CREATE TABLE "password_reset_codes" (
+    "id" UUID NOT NULL,
+    "employee_id" UUID NOT NULL,
+    "code_hash" TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "used_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "created_ip" TEXT,
+    "created_user_agent" TEXT,
+
+    CONSTRAINT "password_reset_codes_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "password_reset_codes_employee_id_created_at_idx" ON "password_reset_codes"("employee_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "password_reset_codes_expires_at_idx" ON "password_reset_codes"("expires_at");
+
+-- AddForeignKey
+ALTER TABLE "password_reset_codes" ADD CONSTRAINT "password_reset_codes_employee_id_fkey" FOREIGN KEY ("employee_id") REFERENCES "employees"("id") ON DELETE CASCADE ON UPDATE CASCADE;