diff --git a/backend/src/main/java/com/xly/erp/modules/usr/dto/CreateUserDTO.java b/backend/src/main/java/com/xly/erp/modules/usr/dto/CreateUserDTO.java
new file mode 100644
index 0000000..289e611
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/dto/CreateUserDTO.java
@@ -0,0 +1,114 @@
+package com.xly.erp.modules.usr.dto;
+
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+import java.util.List;
+
+/**
+ * 新增用户入参（docs/05 契约 / spec § 2.1）。
+ *
+ * <p>REQ-USR-001 T4。Bean Validation 注解校验格式 / 必填 / 枚举；
+ * 关联 id 存在性、枚举兜底后越界判定在 Service 处理。</p>
+ */
+public class CreateUserDTO {
+
+    /** 用户名：必填，3-20 位字母 / 数字 / 下划线，全局唯一。 */
+    @NotBlank(message = "用户名不能为空")
+    @Pattern(regexp = "^[A-Za-z0-9_]{3,20}$", message = "用户名须为 3-20 位字母、数字或下划线")
+    private String sUserName;
+
+    /** 用户号：可选。 */
+    @Size(max = 50, message = "用户号长度不能超过 50")
+    private String sUserNo;
+
+    /** 关联职员 ID：可选，存在性在 Service 校验。 */
+    private Integer iEmployeeId;
+
+    /** 用户类型：可选，为空时 Service 兜底「普通用户」；非空须为合法枚举。 */
+    @Pattern(regexp = "^(普通用户|超级管理员)$", message = "用户类型取值非法")
+    private String sUserType;
+
+    /** 界面语言：必填，取值 ∈ {中文, 英文, 繁体}。 */
+    @NotBlank(message = "语言不能为空")
+    @Pattern(regexp = "^(中文|英文|繁体)$", message = "语言取值非法")
+    private String sLanguage;
+
+    /** 单据修改权限：可选，0 / 1，为空时 Service 兜底 0。 */
+    @Min(value = 0, message = "单据修改权限取值非法")
+    @Max(value = 1, message = "单据修改权限取值非法")
+    private Integer iCanModifyBill;
+
+    /** 权限组 ID 列表：可选，元素存在性在 Service 校验。 */
+    private List<Integer> permissionIds;
+
+    /** 初始密码：可选，为空时 Service 兜底 666666。 */
+    @Size(max = 100, message = "初始密码长度不能超过 100")
+    private String initialPassword;
+
+    public String getSUserName() {
+        return sUserName;
+    }
+
+    public void setSUserName(String sUserName) {
+        this.sUserName = sUserName;
+    }
+
+    public String getSUserNo() {
+        return sUserNo;
+    }
+
+    public void setSUserNo(String sUserNo) {
+        this.sUserNo = sUserNo;
+    }
+
+    public Integer getIEmployeeId() {
+        return iEmployeeId;
+    }
+
+    public void setIEmployeeId(Integer iEmployeeId) {
+        this.iEmployeeId = iEmployeeId;
+    }
+
+    public String getSUserType() {
+        return sUserType;
+    }
+
+    public void setSUserType(String sUserType) {
+        this.sUserType = sUserType;
+    }
+
+    public String getSLanguage() {
+        return sLanguage;
+    }
+
+    public void setSLanguage(String sLanguage) {
+        this.sLanguage = sLanguage;
+    }
+
+    public Integer getICanModifyBill() {
+        return iCanModifyBill;
+    }
+
+    public void setICanModifyBill(Integer iCanModifyBill) {
+        this.iCanModifyBill = iCanModifyBill;
+    }
+
+    public List<Integer> getPermissionIds() {
+        return permissionIds;
+    }
+
+    public void setPermissionIds(List<Integer> permissionIds) {
+        this.permissionIds = permissionIds;
+    }
+
+    public String getInitialPassword() {
+        return initialPassword;
+    }
+
+    public void setInitialPassword(String initialPassword) {
+        this.initialPassword = initialPassword;
+    }
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrEmployee.java b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrEmployee.java
new file mode 100644
index 0000000..5c95dca
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrEmployee.java
@@ -0,0 +1,52 @@
+package com.xly.erp.modules.usr.entity;
+
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.xly.erp.common.base.BaseEntity;
+
+/**
+ * 职员实体，映射 {@code usr_employee}（docs/03 SSoT）。
+ *
+ * <p>REQ-USR-001 T4。本 REQ 仅用于校验 iEmployeeId 存在性（读）。</p>
+ */
+@TableName("usr_employee")
+public class UsrEmployee extends BaseEntity {
+
+    private static final long serialVersionUID = 1L;
+
+    /** 职员 / 员工姓名。 */
+    @TableField("sEmployeeName")
+    private String sEmployeeName;
+
+    /** 员工编号。 */
+    @TableField("sEmployeeNo")
+    private String sEmployeeNo;
+
+    /** 所属部门。 */
+    @TableField("sDepartment")
+    private String sDepartment;
+
+    public String getSEmployeeName() {
+        return sEmployeeName;
+    }
+
+    public void setSEmployeeName(String sEmployeeName) {
+        this.sEmployeeName = sEmployeeName;
+    }
+
+    public String getSEmployeeNo() {
+        return sEmployeeNo;
+    }
+
+    public void setSEmployeeNo(String sEmployeeNo) {
+        this.sEmployeeNo = sEmployeeNo;
+    }
+
+    public String getSDepartment() {
+        return sDepartment;
+    }
+
+    public void setSDepartment(String sDepartment) {
+        this.sDepartment = sDepartment;
+    }
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrPermission.java b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrPermission.java
new file mode 100644
index 0000000..2ed31db
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrPermission.java
@@ -0,0 +1,52 @@
+package com.xly.erp.modules.usr.entity;
+
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.xly.erp.common.base.BaseEntity;
+
+/**
+ * 权限实体，映射 {@code usr_permission}（docs/03 SSoT）。
+ *
+ * <p>REQ-USR-001 T4。本 REQ 仅用于校验 permissionIds 元素存在性（读）。</p>
+ */
+@TableName("usr_permission")
+public class UsrPermission extends BaseEntity {
+
+    private static final long serialVersionUID = 1L;
+
+    /** 权限名称。 */
+    @TableField("sPermissionName")
+    private String sPermissionName;
+
+    /** 权限编码（系统内唯一）。 */
+    @TableField("sPermissionCode")
+    private String sPermissionCode;
+
+    /** 权限分类。 */
+    @TableField("sPermissionCategory")
+    private String sPermissionCategory;
+
+    public String getSPermissionName() {
+        return sPermissionName;
+    }
+
+    public void setSPermissionName(String sPermissionName) {
+        this.sPermissionName = sPermissionName;
+    }
+
+    public String getSPermissionCode() {
+        return sPermissionCode;
+    }
+
+    public void setSPermissionCode(String sPermissionCode) {
+        this.sPermissionCode = sPermissionCode;
+    }
+
+    public String getSPermissionCategory() {
+        return sPermissionCategory;
+    }
+
+    public void setSPermissionCategory(String sPermissionCategory) {
+        this.sPermissionCategory = sPermissionCategory;
+    }
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUser.java b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUser.java
new file mode 100644
index 0000000..b833c67
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUser.java
@@ -0,0 +1,140 @@
+package com.xly.erp.modules.usr.entity;
+
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.xly.erp.common.base.BaseEntity;
+import java.time.LocalDateTime;
+
+/**
+ * 用户实体，映射 {@code usr_user}（docs/03 SSoT）。
+ *
+ * <p>REQ-USR-001 T4。继承 {@link BaseEntity} 复用标准列；密码列 {@code sPassword}
+ * 标注 {@link JsonIgnore} 防止序列化输出。</p>
+ */
+@TableName("usr_user")
+public class UsrUser extends BaseEntity {
+
+    private static final long serialVersionUID = 1L;
+
+    /** 用户名，登录账号，全局唯一。 */
+    @TableField("sUserName")
+    private String sUserName;
+
+    /** 用户号。 */
+    @TableField("sUserNo")
+    private String sUserNo;
+
+    /** 登录密码，BCrypt 哈希存储；禁止序列化输出。 */
+    @JsonIgnore
+    @TableField("sPassword")
+    private String sPassword;
+
+    /** 关联职员 ID（可选）。 */
+    @TableField("iEmployeeId")
+    private Integer iEmployeeId;
+
+    /** 用户类型：普通用户 / 超级管理员。 */
+    @TableField("sUserType")
+    private String sUserType;
+
+    /** 界面语言：中文 / 英文 / 繁体。 */
+    @TableField("sLanguage")
+    private String sLanguage;
+
+    /** 单据修改权限：0 否 / 1 是。 */
+    @TableField("iCanModifyBill")
+    private Integer iCanModifyBill;
+
+    /** 作废 / 禁用标志：0 正常 / 1 已作废。 */
+    @TableField("iIsVoid")
+    private Integer iIsVoid;
+
+    /** 最后登录时间。 */
+    @TableField("tLastLoginDate")
+    private LocalDateTime tLastLoginDate;
+
+    /** 制单人（创建该用户的操作员用户名）。 */
+    @TableField("sCreator")
+    private String sCreator;
+
+    public String getSUserName() {
+        return sUserName;
+    }
+
+    public void setSUserName(String sUserName) {
+        this.sUserName = sUserName;
+    }
+
+    public String getSUserNo() {
+        return sUserNo;
+    }
+
+    public void setSUserNo(String sUserNo) {
+        this.sUserNo = sUserNo;
+    }
+
+    public String getSPassword() {
+        return sPassword;
+    }
+
+    public void setSPassword(String sPassword) {
+        this.sPassword = sPassword;
+    }
+
+    public Integer getIEmployeeId() {
+        return iEmployeeId;
+    }
+
+    public void setIEmployeeId(Integer iEmployeeId) {
+        this.iEmployeeId = iEmployeeId;
+    }
+
+    public String getSUserType() {
+        return sUserType;
+    }
+
+    public void setSUserType(String sUserType) {
+        this.sUserType = sUserType;
+    }
+
+    public String getSLanguage() {
+        return sLanguage;
+    }
+
+    public void setSLanguage(String sLanguage) {
+        this.sLanguage = sLanguage;
+    }
+
+    public Integer getICanModifyBill() {
+        return iCanModifyBill;
+    }
+
+    public void setICanModifyBill(Integer iCanModifyBill) {
+        this.iCanModifyBill = iCanModifyBill;
+    }
+
+    public Integer getIIsVoid() {
+        return iIsVoid;
+    }
+
+    public void setIIsVoid(Integer iIsVoid) {
+        this.iIsVoid = iIsVoid;
+    }
+
+    public LocalDateTime getTLastLoginDate() {
+        return tLastLoginDate;
+    }
+
+    public void setTLastLoginDate(LocalDateTime tLastLoginDate) {
+        this.tLastLoginDate = tLastLoginDate;
+    }
+
+    public String getSCreator() {
+        return sCreator;
+    }
+
+    public void setSCreator(String sCreator) {
+        this.sCreator = sCreator;
+    }
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUserPermission.java b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUserPermission.java
new file mode 100644
index 0000000..efa2810
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/entity/UsrUserPermission.java
@@ -0,0 +1,49 @@
+package com.xly.erp.modules.usr.entity;
+
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.xly.erp.common.base.BaseEntity;
+
+/**
+ * 用户权限关联实体，映射 {@code usr_user_permission}（docs/03 SSoT）。
+ *
+ * <p>REQ-USR-001 T4。用户 ↔ 权限多对多授权；唯一索引 {@code uk_usr_user_permission}
+ * on (iUserId, iPermissionId)。</p>
+ */
+@TableName("usr_user_permission")
+public class UsrUserPermission extends BaseEntity {
+
+    private static final long serialVersionUID = 1L;
+
+    /** 用户 ID，外键 -> usr_user.iIncrement。 */
+    @TableField("iUserId")
+    private Integer iUserId;
+
+    /** 权限 ID，外键 -> usr_permission.iIncrement。 */
+    @TableField("iPermissionId")
+    private Integer iPermissionId;
+
+    public UsrUserPermission() {
+    }
+
+    public UsrUserPermission(Integer iUserId, Integer iPermissionId) {
+        this.iUserId = iUserId;
+        this.iPermissionId = iPermissionId;
+    }
+
+    public Integer getIUserId() {
+        return iUserId;
+    }
+
+    public void setIUserId(Integer iUserId) {
+        this.iUserId = iUserId;
+    }
+
+    public Integer getIPermissionId() {
+        return iPermissionId;
+    }
+
+    public void setIPermissionId(Integer iPermissionId) {
+        this.iPermissionId = iPermissionId;
+    }
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrEmployeeMapper.java b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrEmployeeMapper.java
new file mode 100644
index 0000000..22029d5
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrEmployeeMapper.java
@@ -0,0 +1,12 @@
+package com.xly.erp.modules.usr.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xly.erp.modules.usr.entity.UsrEmployee;
+import org.apache.ibatis.annotations.Mapper;
+
+/**
+ * 职员 Mapper（MyBatis-Plus），本 REQ 用于存在性校验。REQ-USR-001 T4。
+ */
+@Mapper
+public interface UsrEmployeeMapper extends BaseMapper<UsrEmployee> {
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrPermissionMapper.java b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrPermissionMapper.java
new file mode 100644
index 0000000..96bca28
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrPermissionMapper.java
@@ -0,0 +1,12 @@
+package com.xly.erp.modules.usr.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xly.erp.modules.usr.entity.UsrPermission;
+import org.apache.ibatis.annotations.Mapper;
+
+/**
+ * 权限 Mapper（MyBatis-Plus），本 REQ 用于存在性校验。REQ-USR-001 T4。
+ */
+@Mapper
+public interface UsrPermissionMapper extends BaseMapper<UsrPermission> {
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserMapper.java b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserMapper.java
new file mode 100644
index 0000000..2968bc8
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserMapper.java
@@ -0,0 +1,12 @@
+package com.xly.erp.modules.usr.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xly.erp.modules.usr.entity.UsrUser;
+import org.apache.ibatis.annotations.Mapper;
+
+/**
+ * 用户 Mapper（MyBatis-Plus）。REQ-USR-001 T4。
+ */
+@Mapper
+public interface UsrUserMapper extends BaseMapper<UsrUser> {
+}
diff --git a/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserPermissionMapper.java b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserPermissionMapper.java
new file mode 100644
index 0000000..f909fbb
--- /dev/null
+++ b/backend/src/main/java/com/xly/erp/modules/usr/mapper/UsrUserPermissionMapper.java
@@ -0,0 +1,12 @@
+package com.xly.erp.modules.usr.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.xly.erp.modules.usr.entity.UsrUserPermission;
+import org.apache.ibatis.annotations.Mapper;
+
+/**
+ * 用户权限关联 Mapper（MyBatis-Plus）。REQ-USR-001 T4。
+ */
+@Mapper
+public interface UsrUserPermissionMapper extends BaseMapper<UsrUserPermission> {
+}
diff --git a/backend/src/test/java/com/xly/erp/modules/usr/dto/CreateUserDTOValidationTest.java b/backend/src/test/java/com/xly/erp/modules/usr/dto/CreateUserDTOValidationTest.java
new file mode 100644
index 0000000..bba1c66
--- /dev/null
+++ b/backend/src/test/java/com/xly/erp/modules/usr/dto/CreateUserDTOValidationTest.java
@@ -0,0 +1,63 @@
+package com.xly.erp.modules.usr.dto;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import jakarta.validation.Validation;
+import jakarta.validation.Validator;
+import jakarta.validation.ValidatorFactory;
+import java.util.Set;
+import jakarta.validation.ConstraintViolation;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+/**
+ * REQ-USR-001 T4：CreateUserDTO Bean Validation 校验。
+ */
+class CreateUserDTOValidationTest {
+
+    private static ValidatorFactory factory;
+    private static Validator validator;
+
+    @BeforeAll
+    static void setUp() {
+        factory = Validation.buildDefaultValidatorFactory();
+        validator = factory.getValidator();
+    }
+
+    @AfterAll
+    static void tearDown() {
+        if (factory != null) {
+            factory.close();
+        }
+    }
+
+    @Test
+    void rejectsBadUserName() {
+        CreateUserDTO dto = new CreateUserDTO();
+        dto.setSUserName("ab");
+        dto.setSLanguage("中文");
+        Set<ConstraintViolation<CreateUserDTO>> violations = validator.validate(dto);
+        assertThat(violations)
+                .anyMatch(v -> v.getPropertyPath().toString().equals("sUserName"));
+    }
+
+    @Test
+    void rejectsIllegalLanguage() {
+        CreateUserDTO dto = new CreateUserDTO();
+        dto.setSUserName("good_user");
+        dto.setSLanguage("日文");
+        Set<ConstraintViolation<CreateUserDTO>> violations = validator.validate(dto);
+        assertThat(violations)
+                .anyMatch(v -> v.getPropertyPath().toString().equals("sLanguage"));
+    }
+
+    @Test
+    void acceptsMinimalValidBody() {
+        CreateUserDTO dto = new CreateUserDTO();
+        dto.setSUserName("good_user");
+        dto.setSLanguage("中文");
+        Set<ConstraintViolation<CreateUserDTO>> violations = validator.validate(dto);
+        assertThat(violations).isEmpty();
+    }
+}