fix: Excel 批量导入员工时自动设置默认密码（手机号后6位）

与 createEmployee 保持一致，导入时自动生成 passwordHash，
无需管理员再手动重置。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

backend/src/routes/import.routes.ts

@@ -1,6 +1,7 @@
 import { Router, Response, NextFunction } from 'express'
 import multer from 'multer'
 import * as XLSX from 'xlsx'
+import bcrypt from 'bcryptjs'
 import { authMiddleware, AuthRequest } from '../middleware/auth'
 import { requireAdmin } from '../middleware/rbac'
 import { encrypt, decrypt, sha256 } from '../lib/crypto'
@@ -305,6 +306,11 @@ router.post('/excel', authMiddleware, requireAdmin, upload.single('file'), async
           const housingFundOptOut = val(getField(r, '公积金基数')) === '无' || val(getField(r, '公积金基数')) === '不缴'
           const housingFundBase = housingFundOptOut ? 0 : (housingFundBaseVal || num(salary))
 
+          // 默认密码：手机号后6位（无手机号则 123456）
+          const importPhoneVal = val(getField(r, '手机号')) || null
+          const defaultPwd = importPhoneVal ? importPhoneVal.slice(-6) : '123456'
+          const importPasswordHash = await bcrypt.hash(defaultPwd, 10)
+
           const emp = await prisma.employee.create({
             data: {
               orgId, name, department: dept, hireDate,
@@ -312,7 +318,8 @@ router.post('/excel', authMiddleware, requireAdmin, upload.single('file'), async
               gender: val(getField(r, '性别')) || (idCard ? extractGenderFromIdCard(idCard) : null),
               femaleWorkerType: (val(getField(r, '女性岗位类型')) === '工人' || val(getField(r, '女性岗位类型')) === 'WORKER') ? 'WORKER'
                 : (val(getField(r, '女性岗位类型')) === '干部' || val(getField(r, '女性岗位类型')) === 'CADRE') ? 'CADRE' : null,
-              phone: val(getField(r, '手机号')) || null,
+              phone: importPhoneVal,
+              passwordHash: importPasswordHash,
               idCardNumber: idCard ? encrypt(idCard) : null,
               idCardHash: idCard ? sha256(idCard) : null,
               birthDate: idCard ? extractBirthDateFromIdCard(idCard) : null,