feat(flow): 工作台与轨迹优化 + 管理端启用回路 + 本地验签配置修复

- 已办去重: 同一办件一行 + doneCount 累计次数(FlwTaskRepository 查询去重)
- 发起/撤回/重提留痕事件行(状态码 6/7, 无需 DDL); /oapi/flow/progress steps 含撤回/重提步骤
- 管理端新增启用回路: POST /admin/map/enable/{id}、POST /admin/def/enable/{id}; GET /api/flow/def/source 源码查询
- 修复 findEnabledByOrdId 未过滤 status 的隐性缺陷; 新增 DeptLabelSupport 科室标签支撑
- 测试: FlowEngineIT 撤回留痕/已办去重断言、OapiFlowContractIT 撤回步骤断言(94 tests 全过)
- 本地验签修复: 本地 UserBase 无 context-path, yh.open.services 显式覆盖服务目录枚举兜底的 /userbase basePath, 否则出站签名与服务端剥离不对齐 → GetUserInfo 等全部「验签失败」; 生产经 Caddy 挂 /userbase 时删除 services 覆盖

src/main/java/com/yunhai/flowcenter/service/FlowInstanceService.java

@@ -89,6 +89,8 @@ public class FlowInstanceService {
         instance.setStatus(FlwEnums.InstanceStatus.APPROVING.getCode());
         instance.setSubmitTime(LocalDateTime.now());
         instanceRepository.saveAndFlush(instance);
+        appendTraceEvent(instance, FlwEnums.TaskStatus.NODE_SUBMIT, "发起申请",
+                FlwEnums.TaskStatus.SUBMITTED, cmd.submitterId, cmd.submitterName);
         flowEngine.startAdvance(instance, cmd.def);
         publishSubmitted(instance);
         return new ApplyOutcome(instance.getId(), false);
@@ -112,6 +114,8 @@ public class FlowInstanceService {
         instanceRepository.saveAndFlush(instance);
         taskRepository.invalidatePendingByInstance(instance.getId());
         branchRepository.deleteByInstance(instance.getId());
+        appendTraceEvent(instance, FlwEnums.TaskStatus.NODE_RESUBMIT, "重新提交",
+                FlwEnums.TaskStatus.SUBMITTED, cmd.submitterId, cmd.submitterName);
         flowEngine.startAdvance(instance, cmd.def);
         publishSubmitted(instance);
     }
@@ -134,11 +138,39 @@ public class FlowInstanceService {
         instanceRepository.saveAndFlush(instance);
         taskRepository.invalidatePendingByInstance(instanceId);
         branchRepository.invalidateRunningByInstance(instanceId);
+        appendTraceEvent(instance, FlwEnums.TaskStatus.NODE_WITHDRAW, "撤回申请",
+                FlwEnums.TaskStatus.WITHDRAWN, instance.getSubmitterId(), instance.getSubmitterName());
         Map<String, Object> data = new HashMap<>();
         data.put("result", "WITHDRAWN");
         eventPublisher.publishEvent(FlowEvent.of(FlowEvent.Type.WITHDRAWN, instanceId, null, data));
     }
 
+    /**
+     * 轨迹留痕事件行（2026-09-18）：办件级动作（发起/重新提交、撤回）也落一条 flw_task 行，
+     * 让流程轨迹的时间线里这些动作本身可见（原实现只把待办批量置失效，撤回在轨迹上是空白）。
+     *
+     * <p>行 status=6/7 且 node_id 用保留值（submit/resubmit/withdraw，定义模型里不存在）——
+     * 不参与引擎任何判断：不进待办（非 0）、不进已办（handledCodes 不含 6/7）、不挡撤回守卫、
+     * 不进超期扫描与分支失效范围、示意图着色与退回目标解析也天然跳过。
+     */
+    private void appendTraceEvent(FlwInstance instance, String nodeId, String nodeName,
+                                  FlwEnums.TaskStatus status, Integer operatorId, String operatorName) {
+        LocalDateTime now = LocalDateTime.now();
+        com.yunhai.flowcenter.entity.FlwTask row = new com.yunhai.flowcenter.entity.FlwTask();
+        row.setInstanceId(instance.getId());
+        row.setSchId(instance.getSchId());
+        row.setNodeId(nodeId);
+        row.setNodeName(nodeName);
+        // assignee_id 非空：发起/撤回的操作人恒为提交人；缺失（脏数据）时落 0，不产生僵尸待办
+        row.setAssigneeId(operatorId == null ? 0 : operatorId);
+        row.setAssigneeName(operatorName);
+        row.setStatus(status.getCode());
+        row.setArriveTime(now);
+        row.setHandleTime(now);
+        row.setUrgeCount(0);
+        taskRepository.save(row);
+    }
+
     public FlwInstance requireInstance(Long schId, Long instanceId) {
         FlwInstance instance = instanceRepository.findById(instanceId)
                 .orElseThrow(() -> new BizException(ErrorCode.PARAM_ERROR, "办件不存在：" + instanceId));