fix: 修复 CI 时区测试失败 + 依赖安全升级 + 新增依赖检查 workflow

- fix(server): getCourseClock 固定 UTC+8（Asia/Shanghai），与 attendance-settlement 保持一致，
  修复 CI（UTC 容器）下 attendance.lesson-session.spec.ts 失败
- chore(deps): @ant-design/x 2.9.0 / @ant-design/x-markdown 2.9.0 / mermaid 11.16.1；
  直接依赖 dompurify 3.4.13（修复生产依赖 audit 漏洞，mermaid/x-markdown 复用同一份）
- ci: 新增 dependency-check workflow（生产依赖 moderate+ / 全局 critical 失败，outdated 报告）

.gitea/workflows/dependency-check.yml

@@ -0,0 +1,44 @@
+name: Dependency Check
+
+# 依赖安全检查：生产依赖 moderate+ 或全局 critical 漏洞即失败；
+# npm outdated 作为信息输出，不阻断。
+# 注意：npmmirror 未实现 audit 接口，audit 必须显式指定官方 registry。
+
+env:
+  NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
+  NPM_CONFIG_AUDIT: "false"
+  NPM_CONFIG_FUND: "false"
+  NPM_CONFIG_REPLACE_REGISTRY_HOST: always
+  CI: "true"
+
+on:
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '30 2 * * 1'   # 每周一 02:30 复查已发布的新漏洞
+  workflow_dispatch:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    container: node:22.22.0-bookworm
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: https://gitee.com/mirrors_actions/checkout@v4
+        with:
+          github-server-url: https://git.gongxue100.com
+          fetch-depth: 1
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit production dependencies (moderate+)
+        run: npm audit --registry=https://registry.npmjs.org --omit=dev --audit-level=moderate
+
+      - name: Audit all dependencies (critical only)
+        run: npm audit --registry=https://registry.npmjs.org --audit-level=critical
+
+      - name: Outdated report (informational)
+        run: npm outdated --registry=https://registry.npmjs.org || true