feat: strengthen P0 security and operations

Tiku.Api/Controllers/PlatformAdminController.cs

@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Tiku.Api.Contracts;
 using Tiku.Application.PlatformAdmin;
+using Tiku.Application.Auth;
 using Tiku.Application.Security;
 using Tiku.Domain.Platform;
 
@@ -14,6 +15,7 @@ namespace Tiku.Api.Controllers;
 [Route("api/platform-admin")]
 public sealed class PlatformAdminController(
     IPlatformAdminService platformAdminService,
+    IAuthAdministrationService authAdministrationService,
     ICurrentUser currentUser) : ControllerBase
 {
     [HttpGet("overview")]
@@ -134,6 +136,27 @@ public sealed class PlatformAdminController(
         return Ok(await platformAdminService.UpdateStaffStatusAsync(ResolveActor(), request.ToCommand(), cancellationToken));
     }
 
+    [HttpPost("staff/{userId:guid}/password-reset")]
+    [Authorize(Policy = BackendPermissions.PlatformStaffManage)]
+    [EndpointSummary("为平台员工设置一次性临时密码")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ResetStaffPassword(
+        Guid userId,
+        AdministrativePasswordResetDto request,
+        CancellationToken cancellationToken)
+    {
+        var actor = ResolveActor();
+        await authAdministrationService.ResetPasswordAsync(
+            new AdministrativePasswordResetRequest(
+                actor.UserId,
+                userId,
+                null,
+                request.TemporaryPassword,
+                request.Reason),
+            cancellationToken);
+        return NoContent();
+    }
+
     [HttpGet("audit-logs")]
     [Authorize(Policy = BackendPermissions.PlatformAuditView)]
     [EndpointSummary("查询平台审计日志")]