fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/deposits/deposits.controller.ts

@@ -47,12 +47,6 @@ export class DepositsController {
     });
   }
 
-  @Get('pending-refunds')
-  @RequirePermission('deposit:edit')
-  findPendingRefunds() {
-    return this.service.findPendingRefunds();
-  }
-
   @Get('stats')
   @RequirePermission('deposit:view')
   getStats() {
@@ -165,7 +159,7 @@ export class DepositsController {
   }
 
   @Put(':id/refund')
-  @RequirePermission('deposit:edit')
+  @RequirePermission('deposit:refund')
   async refund(@Param('id') id: string, @Body() dto: RefundDepositDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
     const result = await this.service.refund(+id, dto, req.user?.id);
@@ -195,67 +189,6 @@ export class DepositsController {
     return result;
   }
 
-  @Post(':id/request-refund')
-  @RequirePermission('deposit:edit')
-  async requestRefund(@Param('id') id: string, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.requestRefund(+id);
-    await this.logService.log({
-      userId: req.user?.id,
-      username: req.user?.username,
-      module: '押金管理',
-      action: '申请退款',
-      targetId: +id,
-      targetType: 'deposit',
-      detail: '提交退款申请',
-      ipAddress,
-      userAgent,
-    });
-    return result;
-  }
-
-  @Put(':id/approve-refund')
-  @RequirePermission('deposit:approve')
-  async approveRefund(@Param('id') id: string, @Request() req: any) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.approveRefund(+id, req.user?.id);
-    await this.logService.log({
-      userId: req.user?.id,
-      username: req.user?.username,
-      module: '押金管理',
-      action: '审批退款',
-      targetId: +id,
-      targetType: 'deposit',
-      detail: `审批通过 → ${result.refundStatus}`,
-      ipAddress,
-      userAgent,
-    });
-    return result;
-  }
-
-  @Put(':id/reject-refund')
-  @RequirePermission('deposit:approve')
-  async rejectRefund(
-    @Param('id') id: string,
-    @Body() body: { reason: string },
-    @Request() req: any,
-  ) {
-    const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.rejectRefund(+id, body.reason, req.user?.id);
-    await this.logService.log({
-      userId: req.user?.id,
-      username: req.user?.username,
-      module: '押金管理',
-      action: '驳回退款',
-      targetId: +id,
-      targetType: 'deposit',
-      detail: `驳回原因：${body.reason}`,
-      ipAddress,
-      userAgent,
-    });
-    return result;
-  }
-
   @Delete(':id')
   @RequirePermission('deposit:delete')
   async remove(@Param('id') id: string, @Request() req: any) {