fix: add missing @RequirePermission decorators

Adds @RequirePermission to 19 TS GraphQL resolvers across 5
subgraphs (iam, config-service, core-edu, content, msg) per
audit report §6.1. Maps: iam user/role -> IAM_USER_READ;
config-service 5 queries -> CONFIG_USER; core-edu classInfo ->
CLASS_READ, exam -> EXAM_READ, grade -> GRADE_READ, homework
-> HOMEWORK_READ, datascope visibleGrades/visibleExams ->
GRADE_READ/EXAM_READ; content chapter/knowledgePoint/question/
textbook -> CONTENT_*_READ; msg notifications ->
MSG_NOTIFICATION_READ, template -> MSG_NOTIFICATION_MANAGE.
Federation resolveReference left unguarded. Python subgraphs
(data-ana, ai) deferred to follow-up infrastructure work.

services/msg/src/graphql/resolvers/notification.resolver.ts

@@ -21,6 +21,10 @@ import {
   type NotificationEntity,
 } from "../dataloader.service.js";
 import { listByUser } from "../../notifications/notifications.repository.js";
+import {
+  Permissions,
+  RequirePermission,
+} from "../../middleware/permission.guard.js";
 
 /**
  * Notification ObjectType（Federation @key）
@@ -59,25 +63,25 @@ export class Notification {
   @Field()
   updatedAt!: Date;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   relatedEntityType: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   relatedEntityId: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   groupId: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   senderId: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   templateId: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => String, { nullable: true })
   eventId: string | null = null;
 
-  @Field({ nullable: true })
+  @Field(() => Date, { nullable: true })
   readAt: Date | null = null;
 }
 
@@ -103,6 +107,7 @@ export class NotificationResolver {
    * 通过 Apollo Router 访问，直连被 RouterAuthGuard 拒绝（ADR-036）
    */
   @Query(() => [Notification])
+  @RequirePermission(Permissions.MSG_NOTIFICATION_READ)
   async notifications(
     @Args("userId", { type: () => ID }) userId: string,
   ): Promise<NotificationEntity[]> {

services/msg/src/graphql/resolvers/template.resolver.ts

@@ -19,6 +19,10 @@ import {
   DataLoaderService,
   type TemplateEntity,
 } from "../dataloader.service.js";
+import {
+  Permissions,
+  RequirePermission,
+} from "../../middleware/permission.guard.js";
 
 /**
  * NotificationTemplate ObjectType（Federation @key）
@@ -81,6 +85,7 @@ export class TemplateResolver {
    * 通过 Apollo Router 访问，直连被 RouterAuthGuard 拒绝（ADR-036）
    */
   @Query(() => NotificationTemplate, { nullable: true })
+  @RequirePermission(Permissions.MSG_NOTIFICATION_MANAGE)
   async template(
     @Args("id", { type: () => ID }) id: string,
   ): Promise<TemplateEntity | null> {