feat: AIHR 智能人力资源管理系统初始提交

- 员工花名册管理（加密存储、导入导出）
- 薪酬管理（发薪批次、薪酬模版、加班费计算、工资条）
- 社保公积金（多城市配置、版本管理、基数调整）
- 解聘管理（6步流程、证据链、工作交接）
- AI 助手（合同审查、风险预测、RAG 知识库）
- Dashboard 仪表盘
- 设置与通知

backend/src/lib/crypto.ts

@@ -0,0 +1,26 @@
+import crypto from 'crypto'
+
+const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY || 'default-32-byte-encryption-key!!'
+const ALGORITHM = 'aes-256-cbc'
+const KEY = Buffer.from(ENCRYPTION_KEY.padEnd(32, '0').slice(0, 32), 'utf8')
+
+export function encrypt(text: string): string {
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv)
+  let encrypted = cipher.update(text, 'utf8', 'hex')
+  encrypted += cipher.final('hex')
+  return iv.toString('hex') + ':' + encrypted
+}
+
+export function decrypt(encryptedText: string): string {
+  const [ivHex, encrypted] = encryptedText.split(':')
+  const iv = Buffer.from(ivHex, 'hex')
+  const decipher = crypto.createDecipheriv(ALGORITHM, KEY, iv)
+  let decrypted = decipher.update(encrypted, 'hex', 'utf8')
+  decrypted += decipher.final('utf8')
+  return decrypted
+}
+
+export function sha256(text: string): string {
+  return crypto.createHash('sha256').update(text, 'utf8').digest('hex')
+}

backend/src/lib/jwt.ts

@@ -0,0 +1,28 @@
+import jwt from 'jsonwebtoken'
+
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-secret'
+const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET || 'dev-refresh-secret'
+
+export function signAccessToken(payload: { id: string; orgId: string; role: string }): string {
+  return jwt.sign(payload, JWT_SECRET, { expiresIn: '2h' })
+}
+
+export function signRefreshToken(payload: { id: string; orgId: string; role: string }): string {
+  return jwt.sign(payload, JWT_REFRESH_SECRET, { expiresIn: '7d' })
+}
+
+export function verifyAccessToken(token: string): { id: string; orgId: string; role: string } | null {
+  try {
+    return jwt.verify(token, JWT_SECRET) as { id: string; orgId: string; role: string }
+  } catch {
+    return null
+  }
+}
+
+export function verifyRefreshToken(token: string): { id: string; orgId: string; role: string } | null {
+  try {
+    return jwt.verify(token, JWT_REFRESH_SECRET) as { id: string; orgId: string; role: string }
+  } catch {
+    return null
+  }
+}

backend/src/lib/prisma.ts

@@ -0,0 +1,5 @@
+import { PrismaClient } from '@prisma/client'
+
+const prisma = new PrismaClient()
+
+export default prisma