fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/deposits/deposits.service.ts

@@ -114,79 +114,13 @@ export class DepositsService {
     deposit.status =
       deduction > 0 ? (refundAmount > 0 ? 'partial_refund' : 'deducted') : 'refunded';
     if (dto.notes) deposit.notes = dto.notes;
-
-
-    return this.repo.save(deposit);
-  }
-
-  // ---- Refund approval flow ----
-
-  async requestRefund(id: number) {
-    const deposit = await this.repo.findOne({ where: { id } });
-    if (!deposit) throw new NotFoundException('押金记录不存在');
-    if (deposit.status !== 'paid') throw new BadRequestException('该押金已处理');
-    if (deposit.refundStatus) throw new BadRequestException('已提交退款申请，请等待审批');
-
-    deposit.refundStatus = 'pending';
-    deposit.refundRequestedAt = new Date();
-    return this.repo.save(deposit);
-  }
-
-  async approveRefund(id: number, userId: number) {
-    const deposit = await this.repo.findOne({ where: { id } });
-    if (!deposit) throw new NotFoundException('押金记录不存在');
-
-    if (!deposit.refundStatus || deposit.refundStatus === 'refunded') {
-      throw new BadRequestException('未找到待审批的退款申请');
-    }
-
-    const transitions: Record<string, string> = {
-      pending: 'head_teacher_approved',
-      head_teacher_approved: 'finance_approved',
-      finance_approved: 'refunded',
-    };
-
-    const nextStatus = transitions[deposit.refundStatus];
-    if (!nextStatus) throw new BadRequestException(`无效的退款状态: ${deposit.refundStatus}`);
-
-    deposit.refundStatus = nextStatus;
-    deposit.refundApprovedBy = userId;
+    deposit.refundStatus = 'refunded';
+    deposit.refundApprovedBy = userId ?? null as unknown as number;
     deposit.refundApprovedAt = new Date();
 
-    if (nextStatus === 'refunded') {
-      deposit.status = 'refunded';
-      deposit.refundDate = new Date().toISOString().slice(0, 10);
-      deposit.refundAmount = Number(deposit.amount) - Number(deposit.deductionAmount || 0);
-    }
-
     return this.repo.save(deposit);
   }
 
-  async rejectRefund(id: number, reason: string, userId: number) {
-    const deposit = await this.repo.findOne({ where: { id } });
-    if (!deposit) throw new NotFoundException('押金记录不存在');
-
-    if (!deposit.refundStatus || deposit.refundStatus === 'refunded') {
-      throw new BadRequestException('未找到待审批的退款申请');
-    }
-
-    deposit.refundStatus = null as unknown as string;
-    deposit.refundApprovedBy = userId;
-    deposit.refundApprovedAt = new Date();
-    deposit.refundRejectedReason = reason;
-    return this.repo.save(deposit);
-  }
-  async findPendingRefunds() {
-    return this.repo.find({
-      where: [
-        { refundStatus: 'pending' },
-        { refundStatus: 'head_teacher_approved' },
-      ],
-      relations: ['student', 'installments'],
-      order: { refundRequestedAt: 'DESC' },
-    });
-  }
-
   async remove(id: number) {
     const deposit = await this.repo.findOne({ where: { id } });
     if (!deposit) throw new NotFoundException('押金记录不存在');