feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/rbac/rbac.service.ts

@@ -48,6 +48,7 @@ const PRESET_PERMISSIONS: Array<{ code: string; name: string; group: string }> =
   { code: 'rental:edit', name: '编辑租赁订单', group: 'rental' },
   { code: 'rental:delete', name: '删除租赁订单', group: 'rental' },
   { code: 'log:view', name: '查看操作日志', group: 'log' },
+  { code: 'log:create', name: '写入操作日志', group: 'log' },
   { code: 'user:view', name: '查看用户', group: 'user' },
   { code: 'user:create', name: '创建用户', group: 'user' },
   { code: 'user:edit', name: '编辑用户', group: 'user' },
@@ -80,6 +81,9 @@ const PRESET_PERMISSIONS: Array<{ code: string; name: string; group: string }> =
   { code: 'sync:read', name: '查看同步状态', group: 'sync' },
   { code: 'integration:trigger', name: '触发集成', group: 'integration' },
   { code: 'integration:read', name: '查看集成状态', group: 'integration' },
+  { code: 'department:view', name: '查看部门', group: 'department' },
+  { code: 'department:edit', name: '编辑部门', group: 'department' },
+  { code: 'department:delete', name: '删除部门', group: 'department' },
 ];
 
 const PRESET_ROLES: Array<{