fix: 修复 CI 时区测试失败 + 依赖安全升级 + 新增依赖检查 workflow

- fix(server): getCourseClock 固定 UTC+8（Asia/Shanghai），与 attendance-settlement 保持一致，
  修复 CI（UTC 容器）下 attendance.lesson-session.spec.ts 失败
- chore(deps): @ant-design/x 2.9.0 / @ant-design/x-markdown 2.9.0 / mermaid 11.16.1；
  直接依赖 dompurify 3.4.13（修复生产依赖 audit 漏洞，mermaid/x-markdown 复用同一份）
- ci: 新增 dependency-check workflow（生产依赖 moderate+ / 全局 critical 失败，outdated 报告）

apps/admin/package.json

@@ -14,9 +14,9 @@
   },
   "dependencies": {
     "@ant-design/icons": "^6.1.1",
-    "@ant-design/x": "^2.8.0",
+    "@ant-design/x": "^2.9.0",
     "@ant-design/x-card": "^2.9.0",
-    "@ant-design/x-markdown": "^2.8.0",
+    "@ant-design/x-markdown": "^2.9.0",
     "@ant-design/x-sdk": "^2.8.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
@@ -26,10 +26,11 @@
     "antd": "^6.3.6",
     "axios": "^1.15.1",
     "dayjs": "^1.11.20",
+    "dompurify": "^3.4.13",
     "echarts": "^6.0.0",
     "fast-deep-equal": "^3.1.3",
     "file-saver": "^2.0.5",
-    "mermaid": "^11.16.0",
+    "mermaid": "^11.16.1",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
     "react-router": "^8.3.0",

apps/server/src/attendance/attendance-time.ts

@@ -6,7 +6,9 @@ export function toMinutes(time: string): number {
 }
 
 export function getCourseClock(date: Date): { date: string; minutes: number } {
-  const d = dayjs(date);
+  // Asia/Shanghai 无夏令时，固定 UTC+8（与 attendance-settlement 保持一致），
+  // 避免依赖服务器进程时区导致「课程是否已开始」判断漂移。
+  const d = dayjs(date).utcOffset(8);
   return {
     date: d.format('YYYY-MM-DD'),
     minutes: d.hour() * 60 + d.minute(),