fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/attendance/attendance-import.service.ts

@@ -28,6 +28,8 @@ export class AttendanceImportService {
   /** RxJS Subject emitting live progress during import */
   private progressSubject = new Subject<ImportProgressEvent>();
   private isRunning = false;
+  /** ID of the user who triggered the current import (for SSE scoping) */
+  private importingUserId?: number;
   constructor(
     @InjectRepository(DingAttendanceRaw)
     private readonly dingRawRepo: Repository<DingAttendanceRaw>,
@@ -60,7 +62,6 @@ export class AttendanceImportService {
    * 1. Fetch attendance results from DingTalk (paginated)
    * 2. Parse and validate each record
    * 3. Deduplicate by `dingId` (unique in DB)
-   * 4. Batch-save to `ding_attendance_raw`
    * 5. Optionally auto-match to students by name
    */
   async importFromDingTalk(params: {
@@ -68,6 +69,8 @@ export class AttendanceImportService {
     endDate: string;
     userIds?: string[];
     autoMatch?: boolean;
+    /** ID of the HTTP user triggering the import (for SSE event scoping) */
+    userId?: number;
   }): Promise<ImportResult> {
     if (this.isRunning) {
       throw new Error('An import is already in progress');
@@ -75,6 +78,7 @@ export class AttendanceImportService {
 
     const startedAt = Date.now();
     this.isRunning = true;
+    this.importingUserId = params.userId;
 
     // Safety timeout: auto-reset isRunning after 30 minutes in case of
     // an unhandled exception that bypasses the finally block (extremely rare).
@@ -106,6 +110,7 @@ export class AttendanceImportService {
       this.emit('parsing', newRecords.length, total, `${newRecords.length} new records, ${skipped} duplicates skipped`);
 
       if (newRecords.length === 0) {
+        if (params.autoMatch) matched = await this.autoMatchUnmatched();
         this.emit('complete', imported + skipped, total, 'Nothing new to import');
         return { success: true, imported, skipped, matched, errors, duration: Date.now() - startedAt };
       }
@@ -147,6 +152,7 @@ export class AttendanceImportService {
     } finally {
       clearTimeout(safetyTimer);
       this.isRunning = false;
+      this.importingUserId = undefined;
     }
   }
 
@@ -312,6 +318,6 @@ export class AttendanceImportService {
     message: string,
     error?: string,
   ): void {
-    this.progressSubject.next({ phase, current, total, message, error });
+    this.progressSubject.next({ phase, current, total, message, error, userId: this.importingUserId });
   }
 }