fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/entities/attendance-record.entity.ts

@@ -10,10 +10,13 @@ import {
 } from 'typeorm';
 import { Student } from './student.entity';
 import { Class } from './class.entity';
+import { ClassSchedule } from './class-schedule.entity';
+import { AttendanceSession } from './attendance-session.entity';
 
 @Entity('attendance_records')
 @Index(['classId', 'attendanceDate'])
 @Index(['studentId', 'attendanceDate'])
+@Index(['attendanceSessionId', 'studentId'], { unique: true })
 export class AttendanceRecord {
   @PrimaryGeneratedColumn()
   id: number;
@@ -32,6 +35,23 @@ export class AttendanceRecord {
   @JoinColumn({ name: 'class_id' })
   class: Class;
 
+  @Column({ name: 'schedule_id', type: 'integer', nullable: true })
+  scheduleId: number | null;
+
+  @ManyToOne(() => ClassSchedule, { onDelete: 'SET NULL', nullable: true })
+  @JoinColumn({ name: 'schedule_id' })
+  schedule: ClassSchedule | null;
+
+  @Column({ name: 'attendance_session_id', type: 'integer', nullable: true })
+  attendanceSessionId: number | null;
+
+  @ManyToOne(() => AttendanceSession, (session) => session.records, {
+    onDelete: 'SET NULL',
+    nullable: true,
+  })
+  @JoinColumn({ name: 'attendance_session_id' })
+  attendanceSession: AttendanceSession | null;
+
   @Column({ name: 'attendance_date', type: 'date' })
   attendanceDate: string;
 
@@ -41,8 +61,8 @@ export class AttendanceRecord {
   @Column({ length: 20 })
   status: string;
 
-  @Column({ length: 200, nullable: true })
-  remark: string;
+  @Column({ type: 'varchar', length: 200, nullable: true })
+  remark: string | null;
 
   @Column({ name: 'source', length: 20, default: 'manual' })
   source: string;

apps/server/src/entities/attendance-session.entity.ts

@@ -0,0 +1,62 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  OneToMany,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+import { ClassSchedule } from './class-schedule.entity';
+import { Class } from './class.entity';
+import { AttendanceRecord } from './attendance-record.entity';
+
+@Entity('attendance_sessions')
+@Index(['scheduleId', 'lessonDate'], { unique: true })
+export class AttendanceSession {
+  @PrimaryGeneratedColumn()
+  id: number;
+
+  @Column({ name: 'schedule_id', type: 'integer' })
+  scheduleId: number;
+
+  @ManyToOne(() => ClassSchedule, { onDelete: 'RESTRICT' })
+  @JoinColumn({ name: 'schedule_id' })
+  schedule: ClassSchedule;
+
+  @Column({ name: 'class_id', type: 'integer' })
+  classId: number;
+
+  @ManyToOne(() => Class, { onDelete: 'RESTRICT' })
+  @JoinColumn({ name: 'class_id' })
+  class: Class;
+
+  @Column({ name: 'lesson_date', type: 'date' })
+  lessonDate: string;
+
+  @Column({ length: 20, default: 'in_progress' })
+  status: string;
+
+  @Column({ name: 'started_by', type: 'integer', nullable: true })
+  startedBy: number | null;
+
+  @Column({ name: 'started_at', type: 'datetime', nullable: true })
+  startedAt: Date | null;
+
+  @Column({ name: 'completed_by', type: 'integer', nullable: true })
+  completedBy: number | null;
+
+  @Column({ name: 'completed_at', type: 'datetime', nullable: true })
+  completedAt: Date | null;
+
+  @OneToMany(() => AttendanceRecord, (record) => record.attendanceSession)
+  records: AttendanceRecord[];
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt: Date;
+}

apps/server/src/entities/index.ts

@@ -21,6 +21,7 @@ export { ClassStudent } from './class-student.entity';
 export { ClassTeacher, TeacherRoleType } from './class-teacher.entity';
 export { ClassSchedule, ScheduleType } from './class-schedule.entity';
 export { AttendanceRecord } from './attendance-record.entity';
+export { AttendanceSession } from './attendance-session.entity';
 export { DingAttendanceRaw } from './ding-attendance-raw.entity';
 export { SyncLog } from './sync-log.entity';
 export { SyncState } from './sync-state.entity';