feat(api): identity and audit schema with mysql semantics tests

packages/db-cn：@photo/db-cn（prisma 5.22，api/worker 共享 client）+
schema（users/sessions/audit_logs，DateTime(6)、cuid、账号唯一）。
迁移 SQL 手工改写表级 collation 为 utf8mb4_0900_bin——Prisma 生成的 MySQL
DDL 固定 utf8mb4_unicode_ci 会覆盖库级 bin collation，账号/token 大小写
敏感语义依赖它（后续迁移需同样复核）。services/api：@Global PrismaModule
（PrismaService 封装 $connect/$disconnect，池上限仍由
DATABASE_URL_CN ?connection_limit=10 承担）；reset.ts 落地 FK 包裹式
TRUNCATE；e2e 语义复核 4 例（UTC 往返/大小写敏感/audit Json+actor/
session FK Restrict P2003）。pnpm 10 未拦截 prisma engines（平台包内置），
无需 onlyBuiltDependencies。

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/db-cn/prisma/migrations/20260917114313_init_identity/migration.sql

@@ -0,0 +1,50 @@
+-- 注意：Prisma 生成的 MySQL DDL 固定写 utf8mb4_unicode_ci，会覆盖库级
+-- utf8mb4_0900_bin；账号/token 的大小写敏感语义依赖 bin collation，故手工
+-- 改写为 utf8mb4_0900_bin（后续迁移同样需要复核 CREATE TABLE 的 collation）。
+
+-- CreateTable
+CREATE TABLE `users` (
+    `id` VARCHAR(191) NOT NULL,
+    `account` VARCHAR(64) NOT NULL,
+    `passwordHash` VARCHAR(255) NOT NULL,
+    `displayName` VARCHAR(128) NOT NULL,
+    `role` VARCHAR(191) NOT NULL DEFAULT 'staff',
+    `sourceStatus` VARCHAR(191) NOT NULL DEFAULT 'local',
+    `localLocked` BOOLEAN NOT NULL DEFAULT false,
+    `credentialStatus` VARCHAR(191) NOT NULL DEFAULT 'active',
+    `locale` VARCHAR(16) NULL,
+    `createdAt` DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+
+    UNIQUE INDEX `users_account_key`(`account`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_bin;
+
+-- CreateTable
+CREATE TABLE `sessions` (
+    `id` VARCHAR(191) NOT NULL,
+    `userId` VARCHAR(191) NOT NULL,
+    `tokenHash` VARCHAR(64) NOT NULL,
+    `expiresAt` DATETIME(6) NOT NULL,
+    `revokedAt` DATETIME(6) NULL,
+
+    UNIQUE INDEX `sessions_tokenHash_key`(`tokenHash`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_bin;
+
+-- CreateTable
+CREATE TABLE `audit_logs` (
+    `id` VARCHAR(191) NOT NULL,
+    `actorId` VARCHAR(191) NULL,
+    `action` VARCHAR(64) NOT NULL,
+    `resourceId` VARCHAR(64) NULL,
+    `metadata` JSON NULL,
+    `createdAt` DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_bin;
+
+-- AddForeignKey
+ALTER TABLE `sessions` ADD CONSTRAINT `sessions_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `users`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `audit_logs` ADD CONSTRAINT `audit_logs_actorId_fkey` FOREIGN KEY (`actorId`) REFERENCES `users`(`id`) ON DELETE SET NULL ON UPDATE CASCADE;

packages/db-cn/prisma/migrations/migration_lock.toml

@@ -0,0 +1,3 @@
+# Please do not edit this file manually
+# It should be added in your version-control system (i.e. Git)
+provider = "mysql"