feat: 员工端密码登录完整支持

1. createEmployee 创建员工时自动设置默认密码（手机号后6位）
2. 管理员重置密码接口 POST /employees/:id/reset-password
   （重置为手机号后6位）
3. 员工自己修改密码接口 POST /portal/change-password
   （需验证旧密码，新密码至少6位）
4. 花名册详情添加"重置密码"按钮，显示默认密码提示
5. 员工端导航栏添加"修改密码"入口，弹窗修改密码

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

backend/src/services/contract.service.ts

@@ -2,6 +2,7 @@ import prisma from '../lib/prisma'
 import { encrypt, decrypt, sha256 } from '../lib/crypto'
 import { runRiskDetection } from './risk.service'
 import { extractBirthDateFromIdCard, extractGenderFromIdCard } from './retirement.service'
+import bcrypt from 'bcryptjs'
 
 function daysBetween(a: Date, b: Date): number {
   return Math.floor((a.getTime() - b.getTime()) / (1000 * 60 * 60 * 24))
@@ -250,6 +251,9 @@ export async function createEmployee(orgId: string, userId: string, data: any) {
   const housingFundStartMonth = data.housingFundStartMonth || hireMonth
 
   const employee = await prisma.$transaction(async (tx) => {
+    // 默认密码：手机号后6位（员工可在员工端自行修改）
+    const defaultPassword = data.phone ? data.phone.slice(-6) : '123456'
+    const passwordHash = await bcrypt.hash(defaultPassword, 10)
     const emp = await tx.employee.create({
       data: {
         orgId,
@@ -260,6 +264,7 @@ export async function createEmployee(orgId: string, userId: string, data: any) {
         gender: data.gender,
         femaleWorkerType: data.femaleWorkerType,
         phone: data.phone,
+        passwordHash,
         idCardNumber: data.idCardNumber ? encrypt(data.idCardNumber) : null,
         idCardHash: data.idCardNumber ? sha256(data.idCardNumber) : null,
         isPregnant: data.isPregnant || false,