feat(server): P5 基础能力补齐（组织/报销/代办/认证安全）

- 组织/人员/委派对齐：费用类型、部门、员工别名、配置只读与回归脚本（F2/F3/F26/F27/F29/F31/F40）

- 报销单 PATCH/DELETE 与 items CRUD（事务内重算 total_amount）（F4/F5）

- 行政代提交/代上传后端校验与审计（F7/F8）

- 认证安全基线：首次登录改密、失败锁定、弱密码拦截与回归脚本（F36/F37/F39/F41）

server/src/app.js

@@ -22,6 +22,10 @@ const workflowRoutes = require("./routes/workflow");
 const delegationRoutes = require("./routes/delegations");
 const auditRoutes = require("./routes/audit");
 const usersRoutes = require("./routes/users");
+const departmentsRoutes = require("./routes/departments");
+const employeesRoutes = require("./routes/employees");
+const expenseTypesRoutes = require("./routes/expenseTypes");
+const configReadRoutes = require("./routes/configRead");
 const { startDelegationRevokeJob } = require("./jobs/delegationRevokeJob");
 const { startOcrJob } = require("./jobs/ocrJob");
 const { AppError } = require("./utils/AppError");
@@ -191,6 +195,10 @@ async function buildApp() {
   await app.register(delegationRoutes, { prefix: "/api" });
   await app.register(auditRoutes, { prefix: "/api" });
   await app.register(usersRoutes, { prefix: "/api" });
+  await app.register(employeesRoutes, { prefix: "/api" });
+  await app.register(departmentsRoutes, { prefix: "/api" });
+  await app.register(expenseTypesRoutes, { prefix: "/api" });
+  await app.register(configReadRoutes, { prefix: "/api" });
 
   startDelegationRevokeJob(app);
   startOcrJob(app);