feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/common/campus-scope.ts

@@ -36,9 +36,8 @@ export class CampusScope {
     return Number.isNaN(id) ? null : id;
   }
 
-  /** Appends departmentId filter to TypeORM find where conditions */
+  /** Appends departmentId filter. No campus selected = no filtering for super admin; empty result for others. */
   async filter<T extends Record<string, unknown>>(where: T): Promise<T> {
-    // Super admin with no campus selected → no filtering
     if (this.isSuperAdmin && !this.currentDepartmentId) {
       return where;
     }
@@ -55,7 +54,7 @@ export class CampusScope {
     return { ...where, departmentId: In(ids) };
   }
 
-  /** Returns department IDs for QueryBuilder .andWhere() usage. null = no filtering needed. */
+  /** Returns department IDs for QueryBuilder .andWhere(). null = no filtering. */
   async getScopeDepartmentIds(): Promise<number[] | null> {
     if (this.isSuperAdmin && !this.currentDepartmentId) return null;
     const ids = await this.getEffectiveScopeIds();
@@ -63,12 +62,10 @@ export class CampusScope {
   }
 
   private async getEffectiveScopeIds(): Promise<number[]> {
-    // Specific campus selected → campus + descendants
     if (this.currentDepartmentId) {
       return this.departmentsService.getDescendantIds(this.currentDepartmentId);
     }
 
-    // No campus selected → all user departments + descendants
     if (!this.userId) return [];
 
     const userDeptIds = await this.departmentsService.getUserDepartments(this.userId);