feat: add CASL authorization and AI configuration

apps/server/src/attendance/attendance.controller.spec.ts

@@ -15,6 +15,9 @@ describe('AttendanceController — DingTalk import scope', () => {
   const logService = {
     log: jest.fn(),
   };
+  const authzService = {
+    can: jest.fn().mockReturnValue(false),
+  };
 
   let controller: AttendanceController;
 
@@ -24,6 +27,7 @@ describe('AttendanceController — DingTalk import scope', () => {
       attendanceService as unknown as AttendanceService,
       importService as unknown as AttendanceImportService,
       logService as unknown as OperationLogsService,
+      authzService as never,
     );
     importService.importFromDingTalk.mockResolvedValue({
       success: true,
@@ -115,6 +119,7 @@ describe('AttendanceController — DingTalk import scope', () => {
   it('allows class managers to choose any importable class and supply explicit DingTalk users', async () => {
     attendanceService.getImportableClasses.mockResolvedValue([{ classId: 1, className: '一班' }]);
 
+    authzService.can.mockReturnValue(true);
     await expect(
       controller.getDingTalkImportClasses({
         user: {