fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/auth/permission-navigation.ts

@@ -13,11 +13,11 @@ export const PERMISSION_PAGES: readonly PermissionPage[] = [
   { path: '/room-visual', permission: 'room:view' },
   { path: '/rooms', permission: 'room:view' },
   { path: '/occupancies', permission: 'occupancy:view' },
+  { path: '/teacher-workspace', permission: 'teacher-workspace:view' },
   { path: '/students', permission: 'student:view', matches: (p) => p === '/students' || /^\/students\/\d+\/profile$/.test(p) },
   { path: '/classes', permission: 'class:view', matches: (p) => p === '/classes' || /^\/classes\/\d+$/.test(p) },
   { path: '/attendance', permission: 'attendance:view' },
   { path: '/schedules', permission: 'schedule:view' },
-  { path: '/teacher-workspace', permission: 'class:view' },
   { path: '/classroom-schedule', permission: 'rental:view' },
   { path: '/classrooms', permission: 'classroom:view' },
   { path: '/classroom-rentals', permission: 'rental:view' },
@@ -32,7 +32,7 @@ export const PERMISSION_PAGES: readonly PermissionPage[] = [
   { path: '/integration-config', permission: 'integration:read' },
   { path: '/ai-config', permission: 'ai:config:read' },
   { path: '/users', permission: 'user:view' },
-  { path: '/teachers', permission: 'user:view' },
+  { path: '/teachers', permission: 'teacher:view' },
 ] as const;
 
 function matchesPage(page: PermissionPage, pathname: string): boolean {