diff --git a/backend/src/main/java/com/xly/erp/common/response/ErrorCode.java b/backend/src/main/java/com/xly/erp/common/response/ErrorCode.java
index 54b2f9a..2c1fb65 100644
--- a/backend/src/main/java/com/xly/erp/common/response/ErrorCode.java
+++ b/backend/src/main/java/com/xly/erp/common/response/ErrorCode.java
@@ -8,9 +8,12 @@ public enum ErrorCode {
     PARAM_INVALID(40010, "参数错误"),
     MOD_PARENT_NOT_FOUND(40411, "父模块不存在或已删除"),
     MOD_NOT_FOUND(40421, "模块不存在或已删除"),
+    STAFF_NOT_FOUND(40421, "职员不存在或已删除"),
+    PERM_CATEGORY_NOT_FOUND(40422, "权限分类不存在或已删除"),
     MOD_PROC_NAME_DUP(40911, "存储过程名称已存在"),
     MOD_HAS_REFERENCES(40912, "存在子模块或外部业务引用，禁止删除"),
     MOD_PARENT_LOOP(40921, "iParentId 不能等于自身或后代"),
+    USR_USER_NAME_OR_NO_DUP(40921, "用户名或用户号已存在"),
     INTERNAL_ERROR(50000, "服务器内部错误");
 
     private final int code;
diff --git a/backend/src/main/java/com/xly/erp/config/PasswordConfig.java b/backend/src/main/java/com/xly/erp/config/PasswordConfig.java
new file mode 100644
index 0000000..876b404
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/config/PasswordConfig.java
@@ -0,0 +1,19 @@
+package com.xly.erp.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+/**
+ * REQ-USR-001 引入：BCryptPasswordEncoder 注册为 Spring bean，
+ * 供 UserService.create / REQ-USR-004 登录校验复用。strength 用 BCrypt 默认（10）。
+ */
+@Configuration
+public class PasswordConfig {
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}
diff --git a/backend/src/test/java/com/xly/erp/common/response/ApiResponseTest.java b/backend/src/test/java/com/xly/erp/common/response/ApiResponseTest.java
index 12eebe3..7740aa7 100644
--- a/backend/src/test/java/com/xly/erp/common/response/ApiResponseTest.java
+++ b/backend/src/test/java/com/xly/erp/common/response/ApiResponseTest.java
@@ -51,5 +51,8 @@ class ApiResponseTest {
         assertThat(ErrorCode.MOD_NOT_FOUND.getCode()).isEqualTo(40421);
         assertThat(ErrorCode.MOD_PARENT_LOOP.getCode()).isEqualTo(40921);
         assertThat(ErrorCode.MOD_HAS_REFERENCES.getCode()).isEqualTo(40912);
+        assertThat(ErrorCode.STAFF_NOT_FOUND.getCode()).isEqualTo(40421);
+        assertThat(ErrorCode.PERM_CATEGORY_NOT_FOUND.getCode()).isEqualTo(40422);
+        assertThat(ErrorCode.USR_USER_NAME_OR_NO_DUP.getCode()).isEqualTo(40921);
     }
 }