fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/admin/src/pages/Login/index.tsx

@@ -5,7 +5,7 @@ import { UserOutlined, LockOutlined } from '@ant-design/icons';
 import api from '../../api';
 import { message } from '../../ui/app-message';
 import { writePermissions } from '../../auth/permission-store';
-import { findFirstAccessiblePath } from '../../auth/permission-navigation';
+import { findRoleAwareLandingPath } from '../../auth/menu-policy';
 
 const { Title } = Typography;
 
@@ -22,7 +22,7 @@ const LoginPage: React.FC = () => {
       const permissions = res.user.permissions || [];
       writePermissions(permissions);
       message.success('登录成功');
-      navigate(findFirstAccessiblePath(permissions) || '/', { replace: true });
+      navigate(findRoleAwareLandingPath(res.user.roles || [], permissions) || '/', { replace: true });
     } catch (err: any) {
       message.error(err?.message || '登录失败');
     } finally {