fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/pages/Permissions/index.tsx

@@ -19,6 +19,10 @@ const PermissionsPage: React.FC = () => {
   const groupNames: Record<string, string> = {
     dashboard: '数据面板',
     student: '学生管理',
+    'student-scope': '学生数据范围',
+    teacher: '教师管理',
+    'teacher-workspace': '教师工作台',
+    'attendance-scope': '考勤数据范围',
     room: '宿舍管理',
     occupancy: '入住管理',
     expense: '费用管理',