fix: repair 5 sites where StudentDingMapping.studentId was misused as User FK

- dingtalk.service.ts syncOneUser: query studentRepo (not userRepo) by mapping.studentId
- sync.service.ts importDingTalkUsers: skip User role lookup for existing mappings
- attendance.service.ts autoMatchDingRecords: use studentId directly, remove second-hop query
- schedule-sync.service.ts syncAll: skip teacher mapping block (deprecated)
- rbac.service.ts getUnboundUsers: return [] (method deleted in Task 4)

apps/server/src/rbac/rbac.service.ts

@@ -269,14 +269,9 @@ export class RbacService {
     return { success: true };
   }
 
+  // ponytail: StudentDingMapping.studentId is Student FK, not User; method deleted in Task 4
   async getUnboundUsers(): Promise<{ id: number; username: string; name: string }[]> {
-    return this.userRepo
-      .createQueryBuilder('u')
-      .leftJoin(StudentDingMapping, 'm', 'm.studentId = u.id')
-      .where('m.id IS NULL')
-      .andWhere('u.isArchived = false')
-      .select(['u.id', 'u.username', 'u.name'])
-      .getMany();
+    return [];
   }
 
   async findAllRoles(): Promise<Role[]> {