B-64: 安全修复——随机初始密码与跨公司重复上传隔离

- 公司账号创建改为随机一次性初始密码，只在创建响应中显示一次，
  密码保证不等于用户名；删除「用户名即初始密码」兼容分支，继续
  强制首次登录改密。
- 跨公司相同字节文件上传只返回通用重复状态：不再返回其他公司的
  原批次 ID、银行、模板、期间、交易数或诊断；同公司重复上传的
  幂等摘要保持可用。
- 补充服务端回归测试，覆盖同公司与跨公司两个分支及随机密码；
  完整测试 85 项全绿，node --check 通过。

tests/test_persistence.py

@@ -9,7 +9,7 @@ import unittest
 
 from openpyxl import Workbook
 
-from bank_importer.db import applied_versions, connect, migrate, rollback
+from bank_importer.db import applied_versions, connect, migrate, rollback, utc_now
 from bank_importer.importing import import_statement
 
 
@@ -175,6 +175,7 @@ class IdempotencyTests(PersistenceTestCase):
         self.assertEqual("parsed", first.status)
         self.assertEqual("duplicate", second.status)
         self.assertEqual(first.batch_id, second.batch_id)
+        self.assertTrue(second.duplicate_same_company)
 
         files = self.connection.execute("SELECT COUNT(*) AS n FROM source_files").fetchone()
         self.assertEqual(1, files["n"])
@@ -188,6 +189,43 @@ class IdempotencyTests(PersistenceTestCase):
         ).fetchone()
         self.assertEqual(first.batch_id, duplicate["duplicate_of_id"])
 
+    def test_cross_company_duplicate_never_returns_other_companys_batch(self) -> None:
+        now = utc_now()
+        with self.connection:
+            self.connection.execute(
+                "INSERT INTO companies (name, created_at, updated_at) VALUES ('甲公司', ?, ?)",
+                (now, now),
+            )
+            self.connection.execute(
+                "INSERT INTO companies (name, created_at, updated_at) VALUES ('乙公司', ?, ?)",
+                (now, now),
+            )
+        company_a, company_b = [
+            row["id"]
+            for row in self.connection.execute("SELECT id FROM companies ORDER BY id").fetchall()
+        ]
+
+        first = import_statement(
+            self.connection, self.storage, SAMPLE_FILE.name,
+            SAMPLE_FILE.read_bytes(), company_id=company_a,
+        )
+        self.assertEqual("parsed", first.status)
+
+        second = import_statement(
+            self.connection, self.storage, SAMPLE_FILE.name,
+            SAMPLE_FILE.read_bytes(), company_id=company_b,
+        )
+        self.assertEqual("duplicate", second.status)
+        self.assertFalse(second.duplicate_same_company)
+        # The returned batch id is the uploader's own duplicate batch, never
+        # the other company's original batch.
+        self.assertNotEqual(first.batch_id, second.batch_id)
+        self.assertNotEqual(second.batch_id, first.batch_id)
+        own = self.connection.execute(
+            "SELECT company_id FROM import_batches WHERE id = ?", (second.batch_id,)
+        ).fetchone()
+        self.assertEqual(company_b, own["company_id"])
+
     def test_repeated_upload_under_a_different_filename_is_still_duplicate(self) -> None:
         first = self.import_sample()
         second = import_statement(