fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/components/DefaultRoute.tsx

@@ -2,11 +2,18 @@ import React from 'react';
 import { Navigate } from 'react-router-dom';
 import { Result } from 'antd';
 import { usePermission } from '../hooks/usePermission';
-import { findFirstAccessiblePath } from '../auth/permission-navigation';
+import { findRoleAwareLandingPath } from '../auth/menu-policy';
 
 const DefaultRoute: React.FC = () => {
   const { permissions } = usePermission();
-  const firstPath = findFirstAccessiblePath(permissions);
+  const roles = (() => {
+    try {
+      return JSON.parse(localStorage.getItem('user') || '{}').roles || [];
+    } catch {
+      return [];
+    }
+  })();
+  const firstPath = findRoleAwareLandingPath(roles, permissions);
   if (firstPath) return <Navigate to={firstPath} replace />;
   return <Result status="403" title="暂无可访问功能" subTitle="请联系管理员为当前账号分配功能权限" />;
 };

apps/admin/src/components/PermissionRoute.tsx

@@ -1,7 +1,7 @@
 import React from 'react';
 import { Result, Button } from 'antd';
 import { useNavigate } from 'react-router-dom';
-import { findFirstAccessiblePath } from '../auth/permission-navigation';
+import { findRoleAwareLandingPath } from '../auth/menu-policy';
 import { usePermission } from '../hooks/usePermission';
 
 interface PermissionRouteProps {
@@ -13,7 +13,13 @@ const PermissionRoute: React.FC<PermissionRouteProps> = ({ permission, children
   const { permissions, hasPermission } = usePermission();
   const navigate = useNavigate();
   if (!hasPermission(permission)) {
-    const firstPath = findFirstAccessiblePath(permissions);
+    let roles: string[] = [];
+    try {
+      roles = JSON.parse(localStorage.getItem('user') || '{}').roles || [];
+    } catch {
+      roles = [];
+    }
+    const firstPath = findRoleAwareLandingPath(roles, permissions);
     return (
       <Result
         status="403"