fix(security): 认证/越权/注入/上传/凭据全链路加固

由 OCR（open-codereview.ai，deepseek-v4-flash）审查驱动修复：
- JWT 生产必填、密码 8-72 字节、防枚举；全局 ValidationPipe
- classes/dashboard/schedules/students/attendance/archive/exams 越权与 IDOR 修复
- LIKE 通配符转义（14 处）；上传 10MB 上限 + MIME 白名单 + 附件 XSS
- 集成配置 appSecret AES 加密 + 回填脚本；审计 best-effort；IP 来源防伪造

Reviewed-by: OCR (open-codereview.ai)

apps/server/package.json

@@ -14,6 +14,7 @@
     "start:debug": "nest start --debug --watch",
     "start:prod": "node dist/main",
     "generate:student-import": "ts-node -r tsconfig-paths/register -P tsconfig.json scripts/generate-student-import-xlsx.ts",
+    "encrypt:integration-secrets": "ts-node -r tsconfig-paths/register -P tsconfig.json scripts/encrypt-integration-secrets.ts",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\"",
     "lint:fix": "npm run lint -- --fix",
     "typecheck": "tsc -p tsconfig.build.json --noEmit",