本批“考生账号维护”迁移完成：

POST /api/admin/candidate-accounts/archive
POST /api/admin/candidates/{profileId}/reset-password
PATCH /api/admin/candidates/{profileId}
实现了校级按班级/年级归档与恢复、超级管理员密码重置、多级资料审批、事务审计和会话失效。核心代码见

src/Eis.Web/Administration/NativeAdminReadEndpoints.cs

@@ -101,6 +101,16 @@ public static class NativeAdminReadEndpoints
             endpoints.MapGet("/api/admin/payments", (HttpContext context, IAdminOperationalReadService service, CancellationToken cancellationToken) =>
                 Execute(context, service.GetPaymentsAsync(Token(context), cancellationToken)));
         }
+
+        if (options.NativeCandidateManagementEnabled)
+        {
+            endpoints.MapPost("/api/admin/candidate-accounts/archive", (HttpContext context, JsonObject body, IAdminCandidateManagementService service, CancellationToken cancellationToken) =>
+                Execute(context, service.ArchiveAccountsAsync(Token(context), body, cancellationToken)));
+            endpoints.MapPost("/api/admin/candidates/{profileId}/reset-password", (HttpContext context, string profileId, IAdminCandidateManagementService service, CancellationToken cancellationToken) =>
+                Execute(context, service.ResetPasswordAsync(Token(context), profileId, cancellationToken)));
+            endpoints.MapPatch("/api/admin/candidates/{profileId}", (HttpContext context, string profileId, JsonObject body, IAdminCandidateManagementService service, CancellationToken cancellationToken) =>
+                Execute(context, service.ReviewProfileAsync(Token(context), profileId, body, cancellationToken)));
+        }
         return endpoints;
     }
 

src/Eis.Web/Program.cs

@@ -51,7 +51,8 @@ var adminMigrationOptions = AdminMigrationOptions.FromEnvironment(
     builder.Configuration.GetValue<bool>("AdminMigration:NativeConfigurationEnabled"),
     builder.Configuration.GetValue<bool>("AdminMigration:NativeNoticeManagementEnabled"),
     builder.Configuration.GetValue<bool>("AdminMigration:NativeCentersEnabled"),
-    builder.Configuration.GetValue<bool>("AdminMigration:NativeOperationalReadsEnabled"));
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeOperationalReadsEnabled"),
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeCandidateManagementEnabled"));
 builder.Services.AddEisInfrastructure(
     DatabaseOptions.FromEnvironment(applicationRoot, builder.Environment.IsProduction()),
     DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()),
@@ -112,6 +113,7 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
             nativeNoticeManagementEnabled = adminMigrationOptions.NativeNoticeManagementEnabled,
             nativeCentersEnabled = adminMigrationOptions.NativeCentersEnabled,
             nativeOperationalReadsEnabled = adminMigrationOptions.NativeOperationalReadsEnabled,
+            nativeCandidateManagementEnabled = adminMigrationOptions.NativeCandidateManagementEnabled,
             nativeRoutes = (adminMigrationOptions.NativeReadsEnabled
                     ? new[] { "GET context", "GET dashboard", "GET schools", "GET school-organization", "GET admins", "GET exams" }
                     : [])
@@ -137,6 +139,9 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
                 .Concat(adminMigrationOptions.NativeOperationalReadsEnabled
                     ? new[] { "GET candidates", "GET registrations", "GET payments" }
                     : [])
+                .Concat(adminMigrationOptions.NativeCandidateManagementEnabled
+                    ? new[] { "POST candidate-accounts/archive", "POST candidate reset-password", "PATCH candidates" }
+                    : [])
                 .ToArray()
         },
         features = MigrationFeatureCatalog.Current(authenticationOptions.NativeEnabled, candidateMigrationOptions.NativeEnabled)

src/Eis.Web/appsettings.json

@@ -16,7 +16,8 @@
     "NativeConfigurationEnabled": false,
     "NativeNoticeManagementEnabled": false,
     "NativeCentersEnabled": false,
-    "NativeOperationalReadsEnabled": false
+    "NativeOperationalReadsEnabled": false,
+    "NativeCandidateManagementEnabled": false
   },
   "Logging": {
     "LogLevel": {