fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/auth/permission-navigation.integration.test.ts

@@ -11,6 +11,18 @@ describe('permission navigation', () => {
     expect(findFirstAccessiblePath(permissions)).toBe('/classes');
   });
 
+  it('lands teachers on the teacher workspace without global student or class access', () => {
+    expect(
+      findFirstAccessiblePath([
+        'teacher-workspace:view',
+        'schedule:view',
+        'attendance:view',
+      ]),
+    ).toBe('/teacher-workspace');
+    expect(canAccessPath('/students', ['teacher-workspace:view'])).toBe(false);
+    expect(canAccessPath('/classes', ['teacher-workspace:view'])).toBe(false);
+  });
+
   it('uses dashboard when it is the first accessible page', () => {
     expect(findFirstAccessiblePath(['dashboard:view', 'student:view'])).toBe('/dashboard');
   });