feat(portal-shell): wire AppFrame + navigation + permission filter (P1-1)

实现 ARCHITECTURE.md §10 P1-1：
- 新增 src/shared/lib/navigation.ts：27 项静态导航注册表，
  按 teacher/student/parent/admin 四角色分区，group 字段用于角色过滤
- 新增 src/app/shell/layout.tsx：RSC AppFrame，从 headers() 读取
  middleware 注入的身份头，batchCheckRoutePermission 按位图二次过滤
- 新增 src/shared/components/layout/user-menu.tsx：顶部用户菜单，
  显示 userId + role，登出 POST /api/auth/logout
- 新增 src/shared/lib/__tests__/navigation.test.ts：P1-1 验收单测
  （7 用例：href 登记一致性 + 4 角色隔离 + 权限检查）
- 修改 src/shared/lib/route-permissions.ts：补全 7 个列表页根路由
  的 EXACT 登记（/shell/admin/announcements、/shell/admin/classes、
  /shell/teacher/exams 等），与 PREFIX 表互补避免 catch-all 拒绝

验收：
- vitest run navigation → 7/7 passed
- tsc --noEmit 通过；eslint（5 文件）通过

回填 ARCHITECTURE.md §10 P1-1 状态为 ✅，附验收证据。

关联：ARCHITECTURE.md §7.2 AppFrame / §10 P1-1

apps/portal-shell/src/shared/lib/route-permissions.ts

@@ -98,6 +98,16 @@ export const EXACT_ROUTE_PERMISSIONS: Record<string, RoutePermissionConfig> = {
     requiredRoles: ["admin"],
     anyOfPermissions: ["INVITATION_CODE_MANAGE", "INVITATION_CODE_CREATE"],
   },
+  // P1-1：列表页根路由（无尾斜杠）需在 EXACT 表登记，
+  // 否则 middleware checkRoutePermission 落入 /shell/** catch-all 拒绝
+  "/shell/admin/announcements": {
+    requiredRoles: ["admin"],
+    requiredPermissions: ["ANNOUNCEMENT_MANAGE"],
+  },
+  "/shell/admin/classes": {
+    requiredRoles: ["admin"],
+    anyOfPermissions: ["CLASS_READ", "CLASS_MANAGE"],
+  },
 
   // ── teacher 专属 ──────────────────────────────────────────
   "/shell/teacher/lesson-plans": {
@@ -120,6 +130,28 @@ export const EXACT_ROUTE_PERMISSIONS: Record<string, RoutePermissionConfig> = {
     requiredRoles: ["teacher", "admin"],
     anyOfPermissions: ["SCHEDULE_AUTO", "SCHEDULE_ADJUST", "SCHEDULE_MANAGE"],
   },
+  // P1-1：列表页根路由（无尾斜杠）需在 EXACT 表登记，
+  // 与 PREFIX 表（带尾斜杠，匹配子路由如 /shell/teacher/exams/123）互补
+  "/shell/teacher/exams": {
+    requiredRoles: ["teacher", "admin"],
+    anyOfPermissions: ["EXAM_READ", "EXAM_CREATE", "EXAM_UPDATE", "EXAM_GRADE"],
+  },
+  "/shell/teacher/homework": {
+    requiredRoles: ["teacher", "admin"],
+    anyOfPermissions: ["HOMEWORK_READ", "HOMEWORK_CREATE", "HOMEWORK_GRADE"],
+  },
+  "/shell/teacher/grades": {
+    requiredRoles: ["teacher", "admin"],
+    anyOfPermissions: ["GRADE_RECORD_MANAGE", "GRADE_RECORD_READ"],
+  },
+  "/shell/teacher/attendance": {
+    requiredRoles: ["teacher", "admin"],
+    anyOfPermissions: ["ATTENDANCE_READ", "ATTENDANCE_MANAGE"],
+  },
+  "/shell/teacher/diagnostics": {
+    requiredRoles: ["teacher", "admin"],
+    anyOfPermissions: ["DIAGNOSTIC_READ", "DIAGNOSTIC_MANAGE"],
+  },
 
   // ── student 专属 ──────────────────────────────────────────
   "/shell/student/error-book": {