feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/auth/guards/permission.guard.ts

@@ -3,8 +3,17 @@ import { Reflector } from '@nestjs/core';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 import { PERMISSION_KEY } from '../decorators/permission.decorator';
 
-@Injectable()
-export class PermissionGuard implements CanActivate {
+/**
+ * 权限守卫 — 默认放行策略（⚠️ 安全关键）
+ *
+ * 当 handler/controller 上不存在 @RequirePermission 时，守卫放行（仅需登录即可访问）。
+ * 这是有意的设计选择：所有敏感路由必须显式标注 @RequirePermission。
+ *
+ * ⚠️ 新增路由时务必添加 @RequirePermission，否则该路由对所有已认证用户开放！
+ * 建议配合 lint 规则确保无遗漏。
+ */
+ @Injectable()
+ export class PermissionGuard implements CanActivate {
   constructor(private reflector: Reflector) {}
 
   canActivate(context: ExecutionContext): boolean {
@@ -20,8 +29,8 @@ export class PermissionGuard implements CanActivate {
       context.getHandler(),
       context.getClass(),
     ]);
-    // 无装饰器 = 默认拒绝
-    if (!requiredPermissions || requiredPermissions.length === 0) return false;
+    // 无装饰器 = 仅需登录即可，放行
+    if (!requiredPermissions || requiredPermissions.length === 0) return true;
 
     // 3. 从 JWT payload 获取用户权限
     const request = context.switchToHttp().getRequest();