fix: 全面优化安全、性能和代码质量

P0: 环境变量校验/事务保护/RBAC权限
P1: 花名册分页/密码重置验证码/ErrorBoundary/N+1查询优化
P2: 导出限制/自定义错误类/body大小限制/代码去重
P3: 自定义确认弹窗替换window.confirm

backend/src/services/payroll.service.ts

@@ -280,18 +280,29 @@ export async function generatePayslipFromBatches(orgId: string, month: string) {
 
   // 计算累计数据
   const year = month.slice(0, 4)
+  const employeeIds = Array.from(employeeMap.keys())
+
+  const allPrevPayslips = await prisma.payslip.findMany({
+    where: { orgId, employeeId: { in: employeeIds }, month: { startsWith: year, lt: month } },
+    select: { employeeId: true, totalPay: true, tax: true, socialEmp: true, housingEmp: true },
+  })
+  const prevMap = new Map<string, { totalPay: number; tax: number; socialEmp: number; housingEmp: number }>()
+  for (const p of allPrevPayslips) {
+    const existing = prevMap.get(p.employeeId) || { totalPay: 0, tax: 0, socialEmp: 0, housingEmp: 0 }
+    existing.totalPay += p.totalPay
+    existing.tax += p.tax
+    existing.socialEmp += p.socialEmp
+    existing.housingEmp += p.housingEmp
+    prevMap.set(p.employeeId, existing)
+  }
 
   let generated = 0
   for (const [employeeId, summary] of employeeMap) {
-    // 获取当年之前月份的累计数据
-    const prevPayslips = await prisma.payslip.findMany({
-      where: { orgId, employeeId, month: { startsWith: year, lt: month } },
-      select: { totalPay: true, tax: true, socialEmp: true, housingEmp: true },
-    })
-    const ytdIncome = prevPayslips.reduce((s, p) => s + p.totalPay, 0) + summary.totalPay
-    const ytdTaxDeducted = prevPayslips.reduce((s, p) => s + p.tax, 0) + summary.tax
-    const ytdSocialEmp = prevPayslips.reduce((s, p) => s + p.socialEmp, 0) + summary.socialEmp
-    const ytdHousingEmp = prevPayslips.reduce((s, p) => s + p.housingEmp, 0) + summary.housingEmp
+    const prev = prevMap.get(employeeId) || { totalPay: 0, tax: 0, socialEmp: 0, housingEmp: 0 }
+    const ytdIncome = prev.totalPay + summary.totalPay
+    const ytdTaxDeducted = prev.tax + summary.tax
+    const ytdSocialEmp = prev.socialEmp + summary.socialEmp
+    const ytdHousingEmp = prev.housingEmp + summary.housingEmp
 
     await prisma.payslip.upsert({
       where: { employeeId_month: { employeeId, month } },