feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/attendance/attendance.controller.ts

@@ -4,6 +4,7 @@ import {
   Post,
   Put,
   Delete,
+  Sse,
   Body,
   Param,
   Query,
@@ -11,8 +12,11 @@ import {
   Request,
   Res,
 } from '@nestjs/common';
-import type { Response } from 'express';
+import { Observable } from 'rxjs';
+import type { Request as ExpressRequest, Response } from 'express';
 import { AttendanceService } from './attendance.service';
+import { AttendanceImportService } from './attendance-import.service';
+import { DingTalkImportDto } from './dto/dingtalk-import.dto';
 import {
   BatchCreateAttendanceDto,
   AttendanceSummaryQueryDto,
@@ -30,11 +34,27 @@ import { extractRequestInfo } from '../common/request-utils';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
 import * as ExcelJS from 'exceljs';
 
+
+/** SSE event shape for @Sse() decorator */
+interface SseEvent {
+  data: string | Record<string, unknown>;
+  id?: string;
+  type?: string;
+  retry?: number;
+}
+/** Minimal request user shape for type safety */
+interface RequestUser {
+  id: number;
+  username: string;
+  role?: string;
+}
+
 @UseGuards(JwtAuthGuard)
 @Controller()
 export class AttendanceController {
   constructor(
     private readonly service: AttendanceService,
+    private readonly importService: AttendanceImportService,
     private readonly logService: OperationLogsService,
   ) {}
 
@@ -320,4 +340,66 @@ export class AttendanceController {
   async autoMatch() {
     return this.service.autoMatchDingRecords();
   }
+
+  // ═══════════════════════════════════════════════════════════════
+  // DingTalk attendance import with SSE streaming progress
+  // ═══════════════════════════════════════════════════════════════
+
+  /**
+   * Trigger DingTalk attendance import.
+   * Mirrors `dws attendance check result` pipeline:
+   *   fetch → parse → deduplicate → save → auto-match.
+   */
+  @Post('attendance-records/import/dingtalk')
+  @RequirePermission('attendance:create')
+  async importFromDingTalk(
+    @Body() dto: DingTalkImportDto,
+    @Request() req: { user: RequestUser },
+  ) {
+    const { ipAddress, userAgent } = extractRequestInfo(req);
+    const result = await this.importService.importFromDingTalk({
+      startDate: dto.start,
+      endDate: dto.end,
+      userIds: dto.users?.split(',').map((s) => s.trim()).filter(Boolean),
+      autoMatch: dto.autoMatch ?? true,
+    });
+
+    await this.logService.log({
+      userId: req.user?.id,
+      username: req.user?.username,
+      module: '考勤管理',
+      action: '钉钉考勤导入',
+      detail: `${dto.start}~${dto.end}, 导入=${result.imported}, 跳过=${result.skipped}, 匹配=${result.matched}`,
+      ipAddress,
+      userAgent,
+    });
+
+    return result;
+  }
+
+  /**
+   * SSE stream for live import progress.
+   * Connect before triggering the import to receive real-time progress events.
+   *
+   * NOTE: @RequirePermission works with @Sse() in NestJS because guards
+   * execute in the standard request pipeline before the SSE handler is invoked.
+   * If this ever breaks after a NestJS upgrade, verify guard execution order.
+   */
+   @Sse('attendance-records/import/dingtalk/stream')
+  @RequirePermission('attendance:view')
+  importProgressStream(): Observable<SseEvent> {
+    return new Observable<SseEvent>((subscriber) => {
+      const subscription = this.importService.progress$.subscribe({
+        next: (event) => {
+          subscriber.next({ data: JSON.stringify(event) });
+          if (event.phase === 'complete' || event.phase === 'error') {
+            subscriber.complete();
+          }
+        },
+        error: (err: unknown) => subscriber.error(err),
+      });
+      return () => subscription.unsubscribe();
+    });
+  }
+
  }