feat: tkpurchase 시스템 Phase 1 - 협력업체 마스터 + 당일 방문 관리

신규 독립 시스템 tkpurchase (구매/방문 관리) 구축:
- 협력업체 CRUD + 소속 작업자 관리 (마스터 데이터 소유)
- 당일 방문 등록/체크인/체크아웃 + 일괄 마감
- 업체 자동완성, CSV 내보내기, 집계 통계
- 자정 자동 체크아웃 (node-cron)
- tkuser 협력업체 읽기 전용 탭 + 권한 그리드(tkpurchase-perms) 추가
- docker-compose에 tkpurchase-api/web 서비스 추가

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

user-management/api/controllers/partnerController.js

@@ -0,0 +1,39 @@
+const partnerModel = require('../models/partnerModel');
+
+async function list(req, res) {
+  try {
+    const { search, is_active } = req.query;
+    const rows = await partnerModel.findAll({
+      search,
+      is_active: is_active !== undefined ? is_active === 'true' || is_active === '1' : undefined
+    });
+    res.json({ success: true, data: rows });
+  } catch (err) {
+    console.error('Partner list error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function getById(req, res) {
+  try {
+    const company = await partnerModel.findById(req.params.id);
+    if (!company) return res.status(404).json({ success: false, error: '업체를 찾을 수 없습니다' });
+    const workers = await partnerModel.findWorkersByCompany(req.params.id);
+    res.json({ success: true, data: { ...company, workers } });
+  } catch (err) {
+    console.error('Partner get error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function listWorkers(req, res) {
+  try {
+    const rows = await partnerModel.findWorkersByCompany(req.params.id);
+    res.json({ success: true, data: rows });
+  } catch (err) {
+    console.error('Workers list error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+module.exports = { list, getById, listWorkers };

user-management/api/index.js

@@ -17,6 +17,7 @@ const workplaceRoutes = require('./routes/workplaceRoutes');
 const equipmentRoutes = require('./routes/equipmentRoutes');
 const taskRoutes = require('./routes/taskRoutes');
 const vacationRoutes = require('./routes/vacationRoutes');
+const partnerRoutes = require('./routes/partnerRoutes');
 
 const app = express();
 const PORT = process.env.PORT || 3000;
@@ -26,6 +27,7 @@ const allowedOrigins = [
   'https://tkreport.technicalkorea.net',
   'https://tkqc.technicalkorea.net',
   'https://tkuser.technicalkorea.net',
+  'https://tkpurchase.technicalkorea.net',
 ];
 if (process.env.NODE_ENV === 'development') {
   allowedOrigins.push('http://localhost:30080', 'http://localhost:30180', 'http://localhost:30280');
@@ -55,6 +57,7 @@ app.use('/api/workplaces', workplaceRoutes);
 app.use('/api/equipments', equipmentRoutes);
 app.use('/api/tasks', taskRoutes);
 app.use('/api/vacations', vacationRoutes);
+app.use('/api/partners', partnerRoutes);
 
 // 404
 app.use((req, res) => {

user-management/api/models/partnerModel.js

@@ -0,0 +1,29 @@
+const { getPool } = require('./userModel');
+
+async function findAll({ search, is_active } = {}) {
+  const db = getPool();
+  let sql = 'SELECT * FROM partner_companies WHERE 1=1';
+  const params = [];
+  if (is_active !== undefined) { sql += ' AND is_active = ?'; params.push(is_active); }
+  if (search) { sql += ' AND (company_name LIKE ? OR business_number LIKE ?)'; params.push(`%${search}%`, `%${search}%`); }
+  sql += ' ORDER BY company_name';
+  const [rows] = await db.query(sql, params);
+  return rows;
+}
+
+async function findById(id) {
+  const db = getPool();
+  const [rows] = await db.query('SELECT * FROM partner_companies WHERE id = ?', [id]);
+  return rows[0] || null;
+}
+
+async function findWorkersByCompany(companyId) {
+  const db = getPool();
+  const [rows] = await db.query(
+    'SELECT * FROM partner_workers WHERE company_id = ? ORDER BY is_team_leader DESC, worker_name',
+    [companyId]
+  );
+  return rows;
+}
+
+module.exports = { findAll, findById, findWorkersByCompany };

user-management/api/models/permissionModel.js

@@ -52,7 +52,11 @@ const DEFAULT_PAGES = {
   'reports_weekly':     { title: '주간보고서', system: 'system3', group: '보고서', default_access: false },
   'reports_monthly':    { title: '월간보고서', system: 'system3', group: '보고서', default_access: false },
   // AI
-  'ai_assistant':       { title: 'AI 어시스턴트', system: 'system3', group: 'AI', default_access: false }
+  'ai_assistant':       { title: 'AI 어시스턴트', system: 'system3', group: 'AI', default_access: false },
+
+  // ===== tkpurchase - 구매 관리 =====
+  'purchasing_visit':   { title: '방문 관리',     system: 'tkpurchase', group: '구매 관리', default_access: false },
+  'purchasing_partner': { title: '협력업체 관리', system: 'tkpurchase', group: '구매 관리', default_access: false },
 };
 
 /**

user-management/api/routes/partnerRoutes.js

@@ -0,0 +1,12 @@
+const express = require('express');
+const router = express.Router();
+const { requireAuth } = require('../middleware/auth');
+const ctrl = require('../controllers/partnerController');
+
+router.use(requireAuth);
+
+router.get('/', ctrl.list);
+router.get('/:id', ctrl.getById);
+router.get('/:id/workers', ctrl.listWorkers);
+
+module.exports = router;