feat(p3): core teaching service with Outbox + Kafka event bus

P3 阶段交付物：
- services/core-edu: 教学核心服务（DDD 限界上下文：exams/grades/homework/classes）
  - exams: 考试 CRUD + 事务内写 exam + outbox
  - grades: 成绩 CRUD
  - homework: 作业 CRUD
  - classes.module: 复用 P1 classes 模块（聚合到 core-edu 服务）
- Outbox 模式实现：
  - outbox.schema.ts: core_edu_outbox 表（id/aggregate_id/event_type/payload/status/retry_count）
  - outbox.repository.ts: 支持事务参数 tx，确保业务+事件原子性
  - outbox.publisher.ts: Kafka idempotent producer + transactionalId，TOPIC_MAP 路由 9 种事件，MAX_RETRY=5
- config/kafka.ts: idempotent producer + transactionalId 配置
- main.ts: 启动顺序 initTracer → connectKafka → outboxPublisher.start → app.listen
- packages/shared-proto/proto/core_edu.proto: ExamService/HomeworkService/GradeService 契约
- packages/shared-proto/proto/events.proto: ClassEvent/ExamEvent/HomeworkEvent/GradeEvent 领域事件契约

services/core-edu/src/middleware/auth.middleware.ts

@@ -0,0 +1,40 @@
+import {
+  Injectable,
+  NestMiddleware,
+  UnauthorizedException,
+} from '@nestjs/common';
+import type { Request, Response, NextFunction } from 'express';
+
+export interface AuthenticatedUser {
+  id: string;
+  role: string;
+  permissions: string[];
+}
+
+export interface AuthenticatedRequest extends Request {
+  user?: AuthenticatedUser;
+}
+
+@Injectable()
+export class AuthMiddleware implements NestMiddleware {
+  use(req: AuthenticatedRequest, _res: Response, next: NextFunction): void {
+    const userId = req.headers['x-user-id'] as string | undefined;
+    const role = req.headers['x-user-role'] as string | undefined;
+    const permissionsHeader = req.headers['x-user-permissions'] as
+      | string
+      | undefined;
+
+    if (!userId || !role) {
+      throw new UnauthorizedException(
+        'Missing authentication headers (x-user-id, x-user-role)',
+      );
+    }
+
+    req.user = {
+      id: userId,
+      role,
+      permissions: permissionsHeader ? permissionsHeader.split(',') : [],
+    };
+    next();
+  }
+}

services/core-edu/src/middleware/permission.guard.ts

@@ -0,0 +1,48 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  ForbiddenException,
+} from '@nestjs/common';
+import type { AuthenticatedRequest } from './auth.middleware.js';
+
+export const Permissions = {
+  EXAM_CREATE: 'exam:create',
+  EXAM_READ: 'exam:read',
+  EXAM_UPDATE: 'exam:update',
+  EXAM_DELETE: 'exam:delete',
+  HOMEWORK_CREATE: 'homework:create',
+  HOMEWORK_READ: 'homework:read',
+  HOMEWORK_UPDATE: 'homework:update',
+  HOMEWORK_DELETE: 'homework:delete',
+  HOMEWORK_GRADE: 'homework:grade',
+  HOMEWORK_SUBMIT: 'homework:submit',
+  GRADE_CREATE: 'grade:create',
+  GRADE_READ: 'grade:read',
+  GRADE_UPDATE: 'grade:update',
+  GRADE_DELETE: 'grade:delete',
+  CLASS_MANAGE: 'class:manage',
+  CLASS_READ: 'class:read',
+  CLASS_TRANSFER: 'class:transfer',
+} as const;
+
+export type Permission = (typeof Permissions)[keyof typeof Permissions];
+
+@Injectable()
+export class PermissionGuard implements CanActivate {
+  constructor(private readonly requiredPermission: Permission) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const user = request.user;
+    if (!user) {
+      throw new ForbiddenException('User not authenticated');
+    }
+    if (!user.permissions.includes(this.requiredPermission)) {
+      throw new ForbiddenException(
+        `Missing permission: ${this.requiredPermission}`,
+      );
+    }
+    return true;
+  }
+}