fix: add DTO validation, transactional imports, role-not-found handling, null role guard

apps/server/src/sync/sync.controller.ts

@@ -3,6 +3,7 @@ import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
 import { SyncService } from './sync.service';
 import type { SyncPlatform } from '../entities/sync-log.entity';
+import { ImportUsersDto } from './dto/import-users.dto';
 
 @UseGuards(JwtAuthGuard)
 @Controller('sync')
@@ -48,13 +49,15 @@ export class SyncController {
     const tree = await this.syncService.getDingTalkOrgTreeWithUsers(rootId);
     return { success: true, data: tree };
   }
+
   /** 导入钉钉用户：老师分配角色，学生创建 Student */
   @Post('dingtalk/import-users')
   @RequirePermission('sync:trigger')
-  async importDingTalkUsers(@Body() body: { users: Array<{ dingUserId: string; name: string; mobile: string; roleId: number | null }> }) {
+  async importDingTalkUsers(@Body() body: ImportUsersDto) {
     const result = await this.syncService.importDingTalkUsers(body.users);
     return { success: true, ...result };
   }
+
   @Get('logs')
   @RequirePermission('sync:read')
   async getLogs(