feat: sensitive fields removal + phone encryption + click-to-reveal + audit log

backend/src/main/resources/application.yml

@@ -41,6 +41,10 @@ parking:
     weekday-end: "08:00"
     weekends: true
 
+app:
+  encryption:
+    phone-key: ${PHONE_ENCRYPTION_KEY:change-me-to-32-chars!!}
+
 file:
   upload-dir: ./uploads
 

backend/src/main/resources/db/migration/V22__cleanup_and_encrypt.sql

@@ -0,0 +1,20 @@
+ALTER TABLE tb_employee
+  DROP COLUMN IF EXISTS birth_date,
+  DROP COLUMN IF EXISTS residence,
+  DROP COLUMN IF EXISTS education,
+  DROP COLUMN IF EXISTS school_name,
+  DROP COLUMN IF EXISTS major,
+  DROP COLUMN IF EXISTS graduation_date;
+
+CREATE SEQUENCE IF NOT EXISTS sq_audit_logs INCREMENT BY 50;
+
+CREATE TABLE tb_audit_log (
+    id BIGSERIAL PRIMARY KEY,
+    action VARCHAR(50) NOT NULL,
+    target_type VARCHAR(50),
+    target_id BIGINT,
+    actor_id BIGINT,
+    reason VARCHAR(500),
+    ip_address VARCHAR(50),
+    created_at TIMESTAMP
+);