fix: repair 5 sites where StudentDingMapping.studentId was misused as User FK

- dingtalk.service.ts syncOneUser: query studentRepo (not userRepo) by mapping.studentId
- sync.service.ts importDingTalkUsers: skip User role lookup for existing mappings
- attendance.service.ts autoMatchDingRecords: use studentId directly, remove second-hop query
- schedule-sync.service.ts syncAll: skip teacher mapping block (deprecated)
- rbac.service.ts getUnboundUsers: return [] (method deleted in Task 4)

apps/server/src/integration/dingtalk.service.ts

@@ -612,10 +612,10 @@ export class DingTalkService {
     let user: User | null = null;
 
     if (mapping) {
-      user = await this.userRepo.findOne({ where: { id: mapping.studentId } });
-      if (user) {
-        user.name = du.name;
-        await this.userRepo.save(user);
+      const student = await this.studentRepo.findOne({ where: { id: mapping.studentId } });
+      if (student) {
+        student.name = du.name;
+        await this.studentRepo.save(student);
       }
       await this.studentDingMappingRepo.save(mapping);
       return;