…dmin scope separation

- query_meeting_room: add meetingroom/list call, fuzzy room name matching
- list_approvals: force_personal flag (my vs all), fuzzy Chinese name match
- _batch_resolve_user_names: translate userid to Chinese names via contacts API
- _fuzzy_name_match: character-set overlap for one-char differences
- server cleanup: remove 14 sync artifacts, free ~400MB
- tests: updated for new api_wecom.py call patterns (545 passed)

…_id resolution

- Engine now injects 'from' and 'user_id' into ALL tool args (was only generate_document)
- org_admin_tools.py: add _resolve_user_id() helper, fix all 6 handlers
- Deployed to server, 545 passed

…nk security audit

- Knowledge mgmt: clickable org directory nodes with scope filtering
- Admin users: sortable columns + search by dept/name/user_id
- Admin employees: add name search for employee bot activation
- Admin overview: real stats dashboard with user/bot/kb counts
- Security audit: link tokens are HMAC-signed time-limited (1h/24h)

…, employee name edit

- Add scope dropdown for new knowledge and file upload (auto/manual)
- Batch file upload with multiple attribute
- Show tags and content preview after upload
- Employee bot name edit button in admin console
- Fix upload API response keys: knowledge_owner_type -> owner_type
- Fix related tests (545 passed)

- Replace Material Design 3 with Windows 11 Fluent Design tokens
- Color: #0078d4 accent, #faf9f8 surface, #ffffff cards
- Typography: Segoe UI Variable, system-ui fallback
- Buttons: 4px rounded rect (was 999px pills)
- Cards: 8px radius, soft shadow, hover state
- Navigation: acrylic/mica backdrop-filter
- Inputs: focus ring with accent glow
- Tables: clean 2px borders, hover highlight
- Chips: 4px radius, flatter style
- All 3 pages: knowledge, admin console, platform bot
- Update related tests (545 passed)

…me API

- Auto-detect garbled display_name (contains ?? or non-readable) and show default
- Employee column now shows Chinese name (from user data) instead of user_id
- Notify column: translate status codes + add tooltip explanation
- Add dedicated /admin/employee-bots/rename endpoint (no scope/permission side effects)
- Add update_employee_bot_name() in service layer

…rception

- Only pre-intercept single obvious menu words (menu/help/entrance <=3 chars)
- All other messages go through LLM for natural understanding
- Add builtin:get_entry_link tool for LLM to generate admin/knowledge links
- Remove keyword matching for admin/knowledge trigger phrases
- LLM can now handle '后台', '帮我打开管理', '我要去控制台' naturally

…em prompt

- Admin console token now uses 24h TTL (was 1h, kept expiring mid-session)
- System prompt item 5: tell LLM to use get_entry_link for all entry requests
- User can now say '知识库', '后台', '管理页面' and LLM generates correct link
- Updated handoff.md with complete session log

1. Meeting room: fix 600018 '不支持跨天查询' - use same-day time range + meetingroom_id
2. Calendar: lazy-create default calendar via oa/calendar/add, cache cal_id
3. Doc search: update create_doc to wedoc/create_doc path
4. One-time tokens: add JTI (uuid) to all tokens, server-side revocation tracking
5. Project spaces: add POST /api/v1/admin/projects/register for admin registration
6. Feishu/DingTalk: documented credential requirement (can't fix without real creds)