新增 [Eis.Tools (line 1)](C:/Users/BI/Documents/EIS-dotnet/src/Eis.Tools/Program.cs:1)，支持 database init/reset/seed。

数据库维护、安全校验和事务逻辑位于 [DatabaseMaintenanceService.cs (line 1)](C:/Users/BI/Documents/EIS-dotnet/src/Eis.Infrastructure/Data/DatabaseMaintenanceService.cs:1)。
内置完整演示数据：1200 名考生、10800 条成绩、2404 条招生记录。
删除旧 import-test-data.mjs 和 reset-dev-database.mjs 运行入口。
Docker 镜像同时包含 Web 和 /app/tools/Eis.Tools.dll。
[package.json (line 11)](C:/Users/BI/Documents/EIS-dotnet/package.json:11) 原数据库命令已改为调用 .NET。
新增统一发布脚本：[publish.ps1 (line 1)](C:/Users/BI/Documents/EIS-dotnet/scripts/publish.ps1:1)。

scripts/smoke-dotnet-migration.ps1

@@ -245,7 +245,12 @@ try {
         TOTP_ENCRYPTION_KEY         = 'migration-smoke-totp-key-32-characters-minimum'
         DOCUMENT_VERIFICATION_SECRET = 'migration-smoke-document-key-32-characters-minimum'
     }
-    $seedProcess = Start-TestProcess -FileName $nodeExecutable -ArgumentList @('scripts/import-test-data.mjs', '--sqlite') -Environment $nodeEnvironment
+    $seedProcess = Start-TestProcess -FileName $dotnetExecutable -ArgumentList @(
+        'run', '--project', 'src/Eis.Tools', '--',
+        'database', 'seed', '--sqlite',
+        '--path', $smokeDatabasePath,
+        '--confirm-target', $smokeDatabasePath
+    ) -Environment $nodeEnvironment
     if (-not $seedProcess.WaitForExit(30000)) {
         $seedProcess.Kill($true)
         throw 'Timed out while preparing the migration smoke-test database'
@@ -404,6 +409,7 @@ try {
     if ($noticePayload.notice.title -ne 'ASP.NET Core 迁移冒烟通知' -or $noticePayload.notice.content -match '<script') {
         throw 'Native public notice endpoint did not preserve data or sanitize unsafe content'
     }
+    Invoke-RestMethod -Uri "$legacyBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $loginBody -WebSession $session | Out-Null
 
     $candidateSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
     $candidateLoginBody = @{ username = '2026-HZ01-F-0001'; password = '12345678' } | ConvertTo-Json -Compress
@@ -411,6 +417,8 @@ try {
     if ($candidateLogin.user.username -ne '2026-HZ01-F-0001') {
         throw 'Could not sign in as the migration verification candidate'
     }
+    $legacyCandidateSession = [Microsoft.PowerShell.Commands.WebRequestSession]::new()
+    Invoke-RestMethod -Uri "$legacyBaseUrl/api/auth/login" -Method Post -ContentType 'application/json' -Body $candidateLoginBody -WebSession $legacyCandidateSession | Out-Null
 
     $candidateResults = Invoke-RestMethod -Uri "$webBaseUrl/api/candidate/results" -WebSession $candidateSession
     $scoreCode = @($candidateResults.summaries | Where-Object verificationCode | Select-Object -First 1).verificationCode
@@ -509,14 +517,14 @@ try {
         throw 'Native authentication could not create the candidate parity-test session'
     }
     foreach ($candidateRoute in @('dashboard', 'notices', 'profile', 'exams', 'registrations')) {
-        $legacyCandidateResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/$candidateRoute" -WebSession $candidateSession
+        $legacyCandidateResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/$candidateRoute" -WebSession $legacyCandidateSession
         $nativeCandidateResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/$candidateRoute" -WebSession $nativeCandidateSession
         if ($nativeCandidateResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
             throw "Candidate route '$candidateRoute' did not use the native ASP.NET Core endpoint"
         }
         Assert-JsonEquivalent -Expected $legacyCandidateResponse.Content -Actual $nativeCandidateResponse.Content -Label "Candidate route '$candidateRoute'"
     }
-    $legacyCandidateResultsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/results" -WebSession $candidateSession
+    $legacyCandidateResultsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/results" -WebSession $legacyCandidateSession
     $nativeCandidateResultsResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/results" -WebSession $nativeCandidateSession
     if ($nativeCandidateResultsResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
         throw "Candidate route 'results' did not use the native ASP.NET Core endpoint"
@@ -526,7 +534,7 @@ try {
     if (@($nativeCandidateResults.summaries | Where-Object { $_.verificationQr -match '^data:image/png;base64,' }).Count -eq 0) {
         throw 'Native candidate results did not include a local PNG verification QR code'
     }
-    $legacyCandidateAdmissionsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $candidateSession
+    $legacyCandidateAdmissionsResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $legacyCandidateSession
     $nativeCandidateAdmissionsResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions" -WebSession $nativeCandidateSession
     if ($nativeCandidateAdmissionsResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core') {
         throw "Candidate route 'admissions' did not use the native ASP.NET Core endpoint"
@@ -575,7 +583,7 @@ try {
     if ($lockedPreference.StatusCode -ne 409) {
         throw 'Native admission preference API accepted a submission after automatic locking'
     }
-    $legacyAdmissionsAfterWrite = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $candidateSession
+    $legacyAdmissionsAfterWrite = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/admissions" -WebSession $legacyCandidateSession
     $nativeAdmissionsAfterWrite = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/admissions" -WebSession $nativeCandidateSession
     Assert-CandidateAdmissionsEquivalent -Expected $legacyAdmissionsAfterWrite.Content -Actual $nativeAdmissionsAfterWrite.Content
     $appealResultId = $null
@@ -610,7 +618,7 @@ try {
         throw "Could not prepare the candidate admit-card smoke data`n$admitError"
     }
     $admitProcess.Dispose()
-    $legacyAdmitResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/registrations/$admitRegistrationId/admit-card" -WebSession $candidateSession
+    $legacyAdmitResponse = Invoke-WebRequest -Uri "$legacyBaseUrl/api/candidate/registrations/$admitRegistrationId/admit-card" -WebSession $legacyCandidateSession
     $nativeAdmitResponse = Invoke-WebRequest -Uri "$nativeAuthBaseUrl/api/candidate/registrations/$admitRegistrationId/admit-card" -WebSession $nativeCandidateSession
     if ($nativeAdmitResponse.StatusCode -ne 200 -or
         $nativeAdmitResponse.Headers['X-EIS-Implementation'] -ne 'aspnet-core' -or