feat: 项目总群自动建群+任务负责人后台视角+客户群活码进群+任务编辑

- 项目总群：≥3 人 appchat/create 自动建群（chatid=pgc+projectId），成员 diff 增删同步；DROP project_group_chats；推送改 appchat/send 群发、无群降级逐人
- 任务负责人：tasks.owner_userid（新建/编辑任务通讯录选人），task_set_owner 分配即预建 tgc 任务群发介绍，群主链接只归属负责人
- 任务编辑 task_update：基础字段+截图任务数量/关键词/说明，contents 调平只删 available 尾行
- 删除「一键推送」：task-one-click-push-service 整体移除（recordCardAck 移入 wecom-callback-events）
- 负责人后台视角：users.wecom_userid 绑定，lib/owner-scope 行级过滤（undefined=全量/""=空范围/非空=过滤），~30 action 补 managerGate/taskOwnerGate，owner 登录仅见工作台/任务中心/数据回收/复盘报表
- 任务绑定客户群+进群活码：tasks 增 customer_chat_id/name、join_config_id、join_qr_code 4 列，join_way add/update/get/del（换绑走 update 保 config_id 活码不变），后台「客户群」弹窗，portal 认领后扫码自助进群（满员自动开新群）
- 迁移 0013/0014/0015；催办支持按任务；企微可信域名 IP 验证文件
- 288 测试全绿；真机全链路验收通过（列群/活码四端点/portal 渲染/解绑清空）

app/api/users/route.ts

@@ -13,6 +13,7 @@ type UserRow = {
   id: string;
   username: string;
   role: UserRole;
+  wecom_userid: string | null;
   created_at: string;
   updated_at: string;
 };
@@ -28,7 +29,7 @@ async function manager(request: Request) {
 async function listUsers() {
   const result = await getRawDb()
     .prepare(
-      `SELECT id, username, role, created_at, updated_at
+      `SELECT id, username, role, wecom_userid, created_at, updated_at
        FROM users
        ORDER BY CASE role WHEN 'super_admin' THEN 1 WHEN 'admin' THEN 2 ELSE 3 END,
                 created_at ASC`,
@@ -54,6 +55,7 @@ export async function POST(request: Request) {
       password?: string;
       role?: UserRole;
       userId?: string;
+      wecomUserid?: string;
     };
     const db = getRawDb();
 
@@ -65,6 +67,9 @@ export async function POST(request: Request) {
       const passwordRecord = await createPasswordRecord(password);
       const username = normalizeUsername(body.username);
       const role = body.role === "admin" ? "admin" : "user";
+      const wecomUserid = String(body.wecomUserid ?? "")
+        .trim()
+        .slice(0, 128);
       if (!validateUsername(username)) {
         return Response.json(
           { error: "账号需为2—32位中文、字母、数字或 _ . @ + -" },
@@ -77,8 +82,8 @@ export async function POST(request: Request) {
       await db
         .prepare(
           `INSERT INTO users
-            (id, username, password_hash, password_salt, password_iterations, role)
-           VALUES (?, ?, ?, ?, ?, ?)`,
+            (id, username, password_hash, password_salt, password_iterations, role, wecom_userid)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
         )
         .bind(
           crypto.randomUUID(),
@@ -87,8 +92,36 @@ export async function POST(request: Request) {
           passwordRecord.passwordSalt,
           passwordRecord.passwordIterations,
           role,
+          wecomUserid,
         )
         .run();
+    } else if (body.action === "set_wecom") {
+      const wecomUserid = String(body.wecomUserid ?? "")
+        .trim()
+        .slice(0, 128);
+      const target = await db
+        .prepare("SELECT id, role FROM users WHERE id = ?")
+        .bind(String(body.userId ?? ""))
+        .first<{ id: string; role: UserRole }>();
+      if (!target) {
+        return Response.json({ error: "没有找到这个账号" }, { status: 404 });
+      }
+      if (target.role === "super_admin") {
+        return Response.json(
+          { error: "不能修改超级管理员账号" },
+          { status: 403 },
+        );
+      }
+      if (currentUser.role !== "super_admin" && target.role !== "user") {
+        return managerForbidden();
+      }
+      await db
+        .prepare(
+          `UPDATE users SET wecom_userid = ?, updated_at = CURRENT_TIMESTAMP
+           WHERE id = ?`,
+        )
+        .bind(wecomUserid, target.id)
+        .run();
     } else if (body.action === "reset_password") {
       const password = String(body.password ?? "");
       if (!validatePassword(password)) {