feat(server): P5 基础能力补齐（组织/报销/代办/认证安全）

- 组织/人员/委派对齐：费用类型、部门、员工别名、配置只读与回归脚本（F2/F3/F26/F27/F29/F31/F40）

- 报销单 PATCH/DELETE 与 items CRUD（事务内重算 total_amount）（F4/F5）

- 行政代提交/代上传后端校验与审计（F7/F8）

- 认证安全基线：首次登录改密、失败锁定、弱密码拦截与回归脚本（F36/F37/F39/F41）

server/package-lock.json

@@ -7,6 +7,7 @@
     "": {
       "name": "server",
       "version": "1.0.0",
+      "hasInstallScript": true,
       "license": "ISC",
       "dependencies": {
         "@fastify/cookie": "^11.0.2",
@@ -25,7 +26,8 @@
         "pg": "^8.18.0",
         "prisma": "^7.3.0",
         "tencentcloud-sdk-nodejs": "^4.1.14",
-        "zod": "^4.3.6"
+        "zod": "^4.3.6",
+        "zxcvbn": "^4.4.2"
       },
       "devDependencies": {
         "dotenv": "^16.4.5"
@@ -2762,6 +2764,12 @@
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
+    },
+    "node_modules/zxcvbn": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/zxcvbn/-/zxcvbn-4.4.2.tgz",
+      "integrity": "sha512-Bq0B+ixT/DMyG8kgX2xWcI5jUvCwqrMxSFam7m0lAf78nf04hv6lNCsyLYdyYTrCVMqNDY/206K7eExYCeSyUQ==",
+      "license": "MIT"
     }
   }
 }