chore: 保存进行中的未提交改动（企微定向推送+搜索筛选UI等）

保存合并前工作树中遗留的进行中改动，避免分支合并时丢失：
- scheduler: 填报汇总改为定向推送给支局长/领导(而非广播@all)
- router: JWT token 校验修复，bind token(UUID)不被误剥离
- 工作计划/计划列表: 搜索+筛选+分页 UI
- 各列表 API 增加 search 参数支持
- docker-compose.backend.yml + backend/.dockerignore 纳入版本管理

Co-Authored-By: Claude <noreply@anthropic.com>

frontend/src/router/index.ts

@@ -82,8 +82,10 @@ router.beforeEach((to, _from, next) => {
   const auth = useAuthStore()
 
   // Handle WeChat Work OAuth silent login callback: ?token=JWT
+  // Only strip the token if it's a valid JWT — bind tokens (UUID hex) must
+  // survive so pages like WecomBind can read them.
   const tokenParam = to.query.token as string
-  if (tokenParam) {
+  if (tokenParam && tokenParam.split('.').length === 3) {
     // Save token to auth store (the JWT contains user_id, name, role, theme)
     try {
       const payload = JSON.parse(atob(tokenParam.split('.')[1]))
@@ -94,12 +96,12 @@ router.beforeEach((to, _from, next) => {
         role: payload.role,
         theme: payload.theme,
       })
-    } catch (_) { /* invalid token, ignore */ }
-    // Remove token from URL
-    const cleanQuery = { ...to.query }
-    delete cleanQuery.token
-    next({ path: to.path, query: cleanQuery, replace: true })
-    return
+      // Remove token from URL only on successful JWT decode
+      const cleanQuery = { ...to.query }
+      delete cleanQuery.token
+      next({ path: to.path, query: cleanQuery, replace: true })
+      return
+    } catch (_) { /* invalid JWT — leave token for page to handle */ }
   }
 
   if (to.meta.public) {