fix: repair 5 sites where StudentDingMapping.studentId was misused as User FK

- dingtalk.service.ts syncOneUser: query studentRepo (not userRepo) by mapping.studentId
- sync.service.ts importDingTalkUsers: skip User role lookup for existing mappings
- attendance.service.ts autoMatchDingRecords: use studentId directly, remove second-hop query
- schedule-sync.service.ts syncAll: skip teacher mapping block (deprecated)
- rbac.service.ts getUnboundUsers: return [] (method deleted in Task 4)

apps/server/src/sync/sync.service.ts

@@ -199,13 +199,9 @@ export class SyncService {
 
         if (existingMapping) {
           skipped++;
+          // ponytail: studentDingMapping.studentId is Student FK, not User; full rewrite in Task 4
           userId = existingMapping.studentId;
-          // 判断是老师还是学生：查角色
-          const existingUser = await manager.findOne(User, {
-            where: { id: userId },
-            relations: ['roles'],
-          });
-          isTeacher = (existingUser?.roles?.length ?? 0) > 0;
+          isTeacher = false;
         } else {
           // 检查是否已存在（syncAll 或历史导入），避免撞 username 唯一约束
           const username = `dd_${u.dingUserId}`;