feat: 구매/안전 시스템 전면 개편 — tkpurchase 개편 + tksafety 신규 + 권한 보강

Phase 1: tkuser 협력업체 CRUD 이관 (읽기전용 → 전체 CRUD)
Phase 2: tkpurchase 개편 — 일용공 신청/확정, 작업일정, 업무현황, 계정관리, 협력업체 포털
Phase 3: tksafety 신규 시스템 — 방문관리 + 안전교육 신고
Phase 4: SSO 인증 보강 (partner_company_id JWT, 만료일 체크), 권한 테이블 기반 접근 제어

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

user-management/api/controllers/partnerController.js

@@ -26,6 +26,47 @@ async function getById(req, res) {
   }
 }
 
+async function create(req, res) {
+  try {
+    const { company_name } = req.body;
+    if (!company_name || !company_name.trim()) {
+      return res.status(400).json({ success: false, error: '업체명은 필수입니다' });
+    }
+    const company = await partnerModel.create(req.body);
+    res.status(201).json({ success: true, data: company });
+  } catch (err) {
+    if (err.code === 'ER_DUP_ENTRY') {
+      return res.status(400).json({ success: false, error: '이미 등록된 사업자번호입니다' });
+    }
+    console.error('Partner create error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function update(req, res) {
+  try {
+    const company = await partnerModel.update(req.params.id, req.body);
+    if (!company) return res.status(404).json({ success: false, error: '업체를 찾을 수 없습니다' });
+    res.json({ success: true, data: company });
+  } catch (err) {
+    if (err.code === 'ER_DUP_ENTRY') {
+      return res.status(400).json({ success: false, error: '이미 등록된 사업자번호입니다' });
+    }
+    console.error('Partner update error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function deactivate(req, res) {
+  try {
+    await partnerModel.deactivate(req.params.id);
+    res.json({ success: true, message: '비활성화 완료' });
+  } catch (err) {
+    console.error('Partner deactivate error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
 async function listWorkers(req, res) {
   try {
     const rows = await partnerModel.findWorkersByCompany(req.params.id);
@@ -36,4 +77,49 @@ async function listWorkers(req, res) {
   }
 }
 
-module.exports = { list, getById, listWorkers };
+async function createWorker(req, res) {
+  try {
+    const { worker_name, is_team_leader, phone } = req.body;
+    if (!worker_name || !worker_name.trim()) {
+      return res.status(400).json({ success: false, error: '작업자명은 필수입니다' });
+    }
+    if (is_team_leader && (!phone || !phone.trim())) {
+      return res.status(400).json({ success: false, error: '팀장급은 연락처 필수입니다' });
+    }
+    const worker = await partnerModel.createWorker(req.params.id, req.body);
+    res.status(201).json({ success: true, data: worker });
+  } catch (err) {
+    console.error('Worker create error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function updateWorker(req, res) {
+  try {
+    const { is_team_leader, phone } = req.body;
+    if (is_team_leader && (!phone || !phone.trim())) {
+      return res.status(400).json({ success: false, error: '팀장급은 연락처 필수입니다' });
+    }
+    const worker = await partnerModel.updateWorker(req.params.id, req.body);
+    if (!worker) return res.status(404).json({ success: false, error: '작업자를 찾을 수 없습니다' });
+    res.json({ success: true, data: worker });
+  } catch (err) {
+    console.error('Worker update error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+async function deactivateWorker(req, res) {
+  try {
+    await partnerModel.deactivateWorker(req.params.id);
+    res.json({ success: true, message: '비활성화 완료' });
+  } catch (err) {
+    console.error('Worker deactivate error:', err);
+    res.status(500).json({ success: false, error: err.message });
+  }
+}
+
+module.exports = {
+  list, getById, create, update, deactivate,
+  listWorkers, createWorker, updateWorker, deactivateWorker
+};