feat: 员工端密码登录完整支持

1. createEmployee 创建员工时自动设置默认密码（手机号后6位）
2. 管理员重置密码接口 POST /employees/:id/reset-password
   （重置为手机号后6位）
3. 员工自己修改密码接口 POST /portal/change-password
   （需验证旧密码，新密码至少6位）
4. 花名册详情添加"重置密码"按钮，显示默认密码提示
5. 员工端导航栏添加"修改密码"入口，弹窗修改密码

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

backend/src/routes/portal.routes.ts

@@ -123,6 +123,38 @@ router.post('/verify-code', async (req, res, next) => {
   }
 })
 
+/**
+ * 员工修改自己的密码
+ * POST /portal/change-password  body: { oldPassword, newPassword }
+ */
+router.post('/change-password', portalAuth, async (req: any, res, next) => {
+  try {
+    const { oldPassword, newPassword } = req.body
+    if (!oldPassword || !newPassword) {
+      return res.status(400).json({ success: false, error: { code: 'BAD_REQUEST', message: '请输入旧密码和新密码' } })
+    }
+    if (newPassword.length < 6) {
+      return res.status(400).json({ success: false, error: { code: 'VALIDATION_ERROR', message: '新密码至少6位' } })
+    }
+    const employee = await prisma.employee.findFirst({
+      where: { id: req.employee.id },
+      select: { id: true, passwordHash: true },
+    })
+    if (!employee || !employee.passwordHash) {
+      return res.status(400).json({ success: false, error: { code: 'AUTH_FAILED', message: '当前未设置密码，请联系管理员重置' } })
+    }
+    const valid = await bcrypt.compare(oldPassword, employee.passwordHash)
+    if (!valid) {
+      return res.status(400).json({ success: false, error: { code: 'AUTH_FAILED', message: '旧密码错误' } })
+    }
+    const passwordHash = await bcrypt.hash(newPassword, 10)
+    await prisma.employee.update({ where: { id: employee.id }, data: { passwordHash } })
+    res.json({ success: true, data: { message: '密码修改成功' } })
+  } catch (err) {
+    next(err)
+  }
+})
+
 // 工资条
 router.get('/payslip', portalAuth, async (req: any, res, next) => {
   try {