fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/pages/AiConfig/helpers.integration.test.ts

@@ -69,10 +69,10 @@ describe('AiConfig helpers', () => {
   });
 
   describe('extractErrorMessage', () => {
-    it('extracts axios-style response error message', () => {
-      const err = {
-        response: { data: { message: 'API出错' } },
-      };
+    it('extracts message from server error response (interceptor unwraps to { message })', () => {
+      // The Axios interceptor at api/index.ts does Promise.reject(err.response?.data || err).
+      // For server errors, the rejection value is err.response.data — typically { message: '...' }.
+      const err = { message: 'API出错' };
       expect(extractErrorMessage(err)).toBe('API出错');
     });