fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/classes/classes.service.ts

@@ -2,6 +2,7 @@ import {
   Injectable,
   NotFoundException,
   BadRequestException,
+  ConflictException,
   ForbiddenException,
 } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
@@ -12,6 +13,7 @@ import {
   ClassTeacher,
   ClassSchedule,
   AttendanceRecord,
+  AttendanceSession,
   Classroom,
   Student,
   StudentDingMapping,
@@ -45,6 +47,8 @@ export class ClassesService {
     private scheduleRepo: Repository<ClassSchedule>,
     @InjectRepository(AttendanceRecord)
     private attendanceRepo: Repository<AttendanceRecord>,
+    @InjectRepository(AttendanceSession)
+    private attendanceSessionRepo: Repository<AttendanceSession>,
     @InjectRepository(Student)
     private studentRepo: Repository<Student>,
     @InjectRepository(StudentDingMapping)
@@ -288,6 +292,16 @@ export class ClassesService {
     const cls = await this.classRepo.findOne({ where: { id } });
     if (!cls) throw new NotFoundException('班级不存在');
     if (!cls.isArchived) throw new BadRequestException('请先归档再删除');
+
+    const sessionCount = await this.attendanceSessionRepo.count({
+      where: { classId: id },
+    });
+    if (sessionCount > 0) {
+      throw new ConflictException(
+        `无法删除已产生 ${sessionCount} 个考勤场次的班级。请先取消或停用班级以保护历史考勤数据。`,
+      );
+    }
+
     await this.classRepo.remove(cls);
     return { success: true };
   }