feat(server): P5 基础能力补齐（组织/报销/代办/认证安全）

- 组织/人员/委派对齐：费用类型、部门、员工别名、配置只读与回归脚本（F2/F3/F26/F27/F29/F31/F40）

- 报销单 PATCH/DELETE 与 items CRUD（事务内重算 total_amount）（F4/F5）

- 行政代提交/代上传后端校验与审计（F7/F8）

- 认证安全基线：首次登录改密、失败锁定、弱密码拦截与回归脚本（F36/F37/F39/F41）

server/src/constants/permissions.js

@@ -31,7 +31,17 @@ const ROLE_PERMISSIONS = {
     "system.settings",
     "system.audit.view",
   ],
-  administration: ["expense.proxy_submit", "expense.view_own"],
+  administration: [
+    "expense.proxy_submit",
+    "expense.create",
+    "expense.view_own",
+    "expense.edit_own",
+    "expense.delete_own",
+    "expense.submit",
+    "expense.withdraw",
+    "invoice.upload",
+    "invoice.view_own",
+  ],
   hr: ["system.users", "expense.view_all"],
   admin: ["*"],
 };