Refactor employee management

AGENTS.md

@@ -50,7 +50,7 @@ backend-go/
 │   ├── employees_controller.go  # Employee serials: generate, query, update, revoke, qrcode
 │   ├── helper.go            # Helper functions (GetCurrentUser, BindJSON, Response)
 │   ├── serials_controller.go    # Company serials: generate, query, update, revoke, qrcode
-│   └── users_controller.go      # User management (admin): create, list, update, reset password, delete
+│   └── users_controller.go      # Employee master data / backend account management
 ├── database/                # Database connection and migrations
 │   └── database.go          # GORM init, AutoMigrate
 ├── docs/                    # Swagger documentation (auto-generated)
@@ -70,8 +70,8 @@ backend-go/
 │   ├── serials_service.go   # Company serials: generate, query, update, revoke, qrcode
 │   ├── aftersales_service_test.go # Aftersales unit tests
 │   ├── services_test.go     # Auth / Serials / Employees / Companies unit tests
-│   ├── users_service.go     # User CRUD, role management, password reset (admin)
-│   └── users_service_test.go # Users unit tests
+│   ├── users_service.go     # Employee CRUD, role management, password reset (admin)
+│   └── users_service_test.go # Employee/user account unit tests
 ├── tests/                   # Integration tests
 │   └── main_test.go         # End-to-end tests
 ├── data/                    # SQLite data directory
@@ -97,7 +97,15 @@ backend-go/
 - **Aftersales** (技术员+管理员): `POST /api/aftersales`, `GET /api/aftersales`, `GET /api/aftersales/:serialNumber`, `PATCH /api/aftersales/:serialNumber`, `POST /api/aftersales/:serialNumber/qrcode`, `POST /api/aftersales/:serialNumber/submit`
 - **Aftersales** (仅管理员): `POST /api/aftersales/:serialNumber/reassign`, `POST /api/aftersales/:serialNumber/force-close`, `DELETE /api/aftersales/:serialNumber`
 - **Users** (技术员+管理员): `GET /api/users/assignable`
-- **Users** (仅管理员): `POST /api/users`, `GET /api/users`, `PATCH /api/users/:id`, `POST /api/users/:id/reset-password`, `DELETE /api/users/:id`
+- **Employees** (仅管理员): `POST /api/employees`, `GET /api/employees`, `PATCH /api/employees/:id`, `POST /api/employees/:id/reset-password`, `DELETE /api/employees/:id`
+
+### Roles and permissions
+- Roles are limited to `admin`, `technician`, and `employee`.
+- `admin` has full backend access.
+- `technician` only has aftersales/work-order module access.
+- `employee` has no backend login access and does not require a password.
+- Creating an employee through `/api/employees` creates employee master data and automatically generates one employee serial bound by `employeeId`.
+- `admin` / `technician` creation requires an initial password; `employee` creation must not require one.
 
 ### Import Organization
 Standard imports followed by third-party imports, then project imports (sorted alphabetically):