fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/rbac/rbac.teacher-workspace.spec.ts

@@ -0,0 +1,54 @@
+import { RbacService } from './rbac.service';
+
+describe('RbacService getTeacherWorkspace', () => {
+  it('loads today schedules for every assigned class without requiring schedule.teacherId', async () => {
+    const queryBuilder = {
+      where: jest.fn().mockReturnThis(),
+      andWhere: jest.fn().mockReturnThis(),
+      orderBy: jest.fn().mockReturnThis(),
+      getMany: jest.fn().mockResolvedValue([
+        {
+          id: 12,
+          classId: 8,
+          classroomId: 3,
+          teacherId: null,
+          weekDay: new Date().getDay() || 7,
+          startTime: '09:00',
+          endTime: '10:00',
+          subject: '数学',
+          scheduleType: 'INTERNAL',
+        },
+      ]),
+    };
+    const classTeacherRepo = {
+      find: jest.fn().mockResolvedValue([
+        {
+          classId: 8,
+          userId: 21,
+          roleType: 'subject_teacher',
+          subject: '数学',
+          class: { id: 8, name: '一班', code: 'C001' },
+        },
+      ]),
+    };
+    const classStudentRepo = { find: jest.fn().mockResolvedValue([]) };
+    const classScheduleRepo = { createQueryBuilder: jest.fn().mockReturnValue(queryBuilder) };
+    const service = new RbacService(
+      {} as never,
+      {} as never,
+      {} as never,
+      {} as never,
+      classStudentRepo as never,
+      classTeacherRepo as never,
+      classScheduleRepo as never,
+      {} as never,
+    );
+
+    const result = await service.getTeacherWorkspace(21);
+
+    expect(result.todaySchedules).toHaveLength(1);
+    expect(queryBuilder.andWhere).not.toHaveBeenCalledWith('cs.teacherId = :userId', {
+      userId: 21,
+    });
+  });
+});