fix: audit remediation — SSE user scoping, FK transactional safety, UI error handling

- H4: scoped SSE import progress to exact userId match; non-HTTP events excluded from all subscribers
- H2: moved PRAGMA foreign_key_check inside SQLite transaction before COMMIT; violations rollback preserving old tables
- M1: removed dead axios-style error branch from extractErrorMessage (interceptor already unwraps)
- M2: split handleSave try/catch — save errors vs reload errors shown distinctly
- M3: added provider field validation before AI config test request
- Added SSE scoping regression tests (import service + controller)
- Added FK check failure rollback test (database-migrations.spec)
- Updated controller spec expectations for userId parameter

Co-authored-by: Code Review <branch-review>

apps/server/src/students/students.service.ts

@@ -27,6 +27,14 @@ export class StudentsService {
     return [...new Set(assignments.map((assignment) => assignment.classId))];
   }
 
+  async getBasicLookups() {
+    return this.repo.find({
+      select: ['id', 'name', 'studentNo', 'gender', 'phone', 'status'],
+      where: { status: 'active' },
+      order: { name: 'ASC' },
+    });
+  }
+
   async findAll(
     query?: {
       name?: string;