feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/sync/sync.service.ts

@@ -33,7 +33,7 @@ export class SyncService {
   }
 
   // ── Sync DingTalk ──
-  async syncDingTalk(): Promise<SyncLog> {
+  async syncDingTalk(rootDeptId = 1): Promise<SyncLog> {
     const platform: SyncPlatform = 'dingtalk';
     const syncType = await this.determineSyncType(platform);
 
@@ -45,7 +45,7 @@ export class SyncService {
 
       // ── Call existing integration APIs ──
       // Integration hooks — extend here to call DingTalk APIs with lastSyncAt
-      const recordsCount = await this.performDingTalkSync(lastSyncAt);
+      const recordsCount = await this.performDingTalkSync(lastSyncAt, rootDeptId);
 
       await this.updateLastSyncAt(platform);
       await this.finishSyncLog(log, 'success', recordsCount);
@@ -87,10 +87,15 @@ export class SyncService {
   }
 
   // ── Manual trigger ──
-  async triggerSync(platform?: SyncPlatform): Promise<SyncLog[]> {
-    if (platform === 'dingtalk') return [await this.syncDingTalk()];
+  async triggerSync(platform?: SyncPlatform, rootDeptId = 1): Promise<SyncLog[]> {
+    if (platform === 'dingtalk') return [await this.syncDingTalk(rootDeptId)];
     if (platform === 'wecom') return [await this.syncWeCom()];
-    return [await this.syncDingTalk(), await this.syncWeCom()];
+    return [await this.syncDingTalk(rootDeptId), await this.syncWeCom()];
+  }
+
+  /** 获取钉钉组织部门树，供前端选择同步起点 */
+  async getDingTalkOrgTree(rootDeptId = 1) {
+    return this.dingTalkService.fetchOrgTree(rootDeptId);
   }
 
   // ── Sync log queries ──
@@ -154,9 +159,9 @@ export class SyncService {
     await this.syncLogRepo.save(log);
   }
 
-  private async performDingTalkSync(lastSyncAt: Date | null): Promise<number> {
+  private async performDingTalkSync(lastSyncAt: Date | null, rootDeptId = 1): Promise<number> {
     // Stage 1: Sync departments and users
-    const result = await this.dingTalkService.syncAll();
+    const result = await this.dingTalkService.syncAll(rootDeptId);
     let total = result.deptCount + result.userCount;
 
     // Stage 2: Import attendance data (last 7 days or since last sync)
@@ -175,7 +180,7 @@ export class SyncService {
 
       this.logger.log(`Importing DingTalk attendance: ${start} ~ ${end}`);
       const mappings = await this.mappingRepo.find();
-      const userIds = mappings.map((m) => m.dingUserId).filter(Boolean);
+      const userIds = mappings.map((m) => m.dingUserId);
       const importResult = await this.attendanceImportService.importFromDingTalk({
         startDate: start,
         endDate: end,