feat: HR Portal - Complete Multi-Tenant System with Redis Session Storage

Major Features:
- ✅ Multi-tenant architecture (tenant isolation)
- ✅ Employee CRUD with lifecycle management (onboarding/offboarding)
- ✅ Department tree structure with email domain management
- ✅ Company info management (single-record editing)
- ✅ System functions CRUD (permission management)
- ✅ Email account management (multi-account per employee)
- ✅ Keycloak SSO integration (auth.lab.taipei)
- ✅ Redis session storage (10.1.0.254:6379)
  - Solves Cookie 4KB limitation
  - Cross-system session sharing
  - Sliding expiration (8 hours)
  - Automatic token refresh

Technical Stack:
Backend:
- FastAPI + SQLAlchemy
- PostgreSQL 16 (10.1.0.20:5433)
- Keycloak Admin API integration
- Docker Mailserver integration (SSH)
- Alembic migrations

Frontend:
- Next.js 14 (App Router)
- NextAuth 4 with Keycloak Provider
- Redis session storage (ioredis)
- Tailwind CSS

Infrastructure:
- Redis 7 (10.1.0.254:6379) - Session + Cache
- Keycloak 26.1.0 (auth.lab.taipei)
- Docker Mailserver (10.1.0.254)

Architecture Highlights:
- Session管理由 Keycloak + Redis 統一控制
- 支援多系統 (HR/WebMail/Calendar/Drive/Office) 共享 session
- Token 自動刷新,異質服務整合
- 未來可無縫遷移到雲端

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

scripts/fix-postgres-port.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+#
+# 修復 PostgreSQL 端口綁定
+# 讓 PostgreSQL 可以從外部訪問
+#
+
+set -e
+
+echo "=========================================="
+echo "  Fix PostgreSQL Port Binding"
+echo "=========================================="
+echo ""
+
+# 1. 檢查現有 PostgreSQL 容器
+echo "[1/5] Checking existing PostgreSQL container..."
+docker ps -a | grep postgres
+
+echo ""
+echo "Current port bindings:"
+docker port postgres 2>/dev/null || echo "No port bindings found"
+
+echo ""
+read -p "Continue to reconfigure PostgreSQL? (yes/no): " CONFIRM
+
+if [ "$CONFIRM" != "yes" ]; then
+    echo "Aborted."
+    exit 0
+fi
+
+echo ""
+
+# 2. 備份現有配置
+echo "[2/5] Getting container information..."
+
+# Get current postgres password
+POSTGRES_PASSWORD=$(docker exec postgres env | grep POSTGRES_PASSWORD | cut -d= -f2)
+if [ -z "$POSTGRES_PASSWORD" ]; then
+    read -sp "Enter postgres superuser password: " POSTGRES_PASSWORD
+    echo ""
+fi
+
+# Check for data volume
+VOLUME_NAME=$(docker inspect postgres --format '{{range .Mounts}}{{if eq .Destination "/var/lib/postgresql/data"}}{{.Name}}{{end}}{{end}}')
+if [ -z "$VOLUME_NAME" ]; then
+    VOLUME_NAME="postgres-data"
+    echo "  Using default volume name: $VOLUME_NAME"
+else
+    echo "  Found existing volume: $VOLUME_NAME"
+fi
+
+echo ""
+
+# 3. 停止並移除舊容器
+echo "[3/5] Stopping and removing old container..."
+docker stop postgres
+docker rm postgres
+
+echo "  ✓ Old container removed"
+echo ""
+
+# 4. 重新啟動容器,綁定到所有網路介面
+echo "[4/5] Starting new PostgreSQL container..."
+
+docker run -d \
+  --name postgres \
+  --restart unless-stopped \
+  -e POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
+  -e POSTGRES_INITDB_ARGS="--encoding=UTF-8 --locale=en_US.UTF-8" \
+  -e TZ=Asia/Taipei \
+  -p 0.0.0.0:5432:5432 \
+  -v ${VOLUME_NAME}:/var/lib/postgresql/data \
+  postgres:16
+
+echo "  ✓ New container started"
+echo ""
+
+# 5. 等待 PostgreSQL 啟動
+echo "[5/5] Waiting for PostgreSQL to be ready..."
+sleep 5
+
+for i in {1..30}; do
+    if docker exec postgres pg_isready -U postgres >/dev/null 2>&1; then
+        echo "  ✓ PostgreSQL is ready!"
+        break
+    fi
+    echo "  Waiting... ($i/30)"
+    sleep 1
+done
+
+echo ""
+
+# 驗證配置
+echo "Verifying configuration..."
+echo ""
+echo "Port bindings:"
+docker port postgres
+
+echo ""
+echo "Testing local connection:"
+docker exec postgres psql -U postgres -c "SELECT version();" | head -3
+
+echo ""
+echo "Database list:"
+docker exec postgres psql -U postgres -lqt | cut -d \| -f 1 | grep -v "^$" | grep -v "template"
+
+echo ""
+echo "=========================================="
+echo "  ✓ Configuration Complete!"
+echo "=========================================="
+echo ""
+echo "PostgreSQL is now accessible from external hosts"
+echo ""
+echo "Connection details:"
+echo "  Host: 10.1.0.254"
+echo "  Port: 5432"
+echo "  Databases: postgres, hr_portal (if created)"
+echo ""
+echo "Test from Windows:"
+echo "  psql -h 10.1.0.254 -U hr_user -d hr_portal"
+echo ""
+echo "Or update backend/.env:"
+echo "  DATABASE_URL=postgresql://hr_user:DC1qaz2wsx@10.1.0.254:5432/hr_portal"
+echo ""