refactor: RBAC权限系统重构 + UI组件拆分 + 测试修复 + 架构文档

- RBAC: 新增30个权限点、DataScope行级权限、requirePermission守卫，所有57+ Server Action接入权限校验
- UI拆分: exam-form(1623行→11文件)、textbook-reader(744行→7文件)，均降至300行以内
- 测试: 新增5个单元测试文件(19用例)，修复4个集成测试文件(38用例全部通过)
- 架构文档: 新增架构影响地图(004/005)、标准功能清单(006)、差距审计报告(007)
- 项目规则: 架构图优先规则，改码必同步图
- 安全: rehype-sanitize净化、AES加密API Key、权限路由守卫
- 无障碍: skip-link、aria-label、prefers-reduced-motion
- 性能: next/font优化、next/image、代码分割

src/modules/layout/components/app-sidebar.tsx

@@ -3,7 +3,6 @@
 import * as React from "react"
 import Link from "next/link"
 import { usePathname } from "next/navigation"
-import { useSession } from "next-auth/react"
 import { ChevronRight } from "lucide-react"
 
 import {
@@ -19,6 +18,8 @@ import {
   TooltipTrigger,
 } from "@/shared/components/ui/tooltip"
 import { cn } from "@/shared/lib/utils"
+import { usePermission } from "@/shared/hooks"
+import { Permissions, type Permission } from "@/shared/types/permissions"
 import { useSidebar } from "./sidebar-provider"
 import { NAV_CONFIG, Role } from "../config/navigation"
 
@@ -29,10 +30,31 @@ interface AppSidebarProps {
 export function AppSidebar({ mode }: AppSidebarProps) {
   const { expanded, toggleSidebar, isMobile } = useSidebar()
   const pathname = usePathname()
-  const { data } = useSession()
-  const currentRole = (data?.user?.role ?? "teacher") as Role
+  const { permissions, hasRole } = usePermission()
 
-  const navItems = NAV_CONFIG[currentRole] ?? NAV_CONFIG.teacher
+  // Determine which role's nav config to use based on permissions
+  let currentRole: Role = "teacher"
+  if (permissions.includes(Permissions.SCHOOL_MANAGE)) {
+    currentRole = "admin"
+  } else if (permissions.includes(Permissions.HOMEWORK_SUBMIT) && !permissions.includes(Permissions.EXAM_CREATE)) {
+    currentRole = "student"
+  } else if (hasRole("parent")) {
+    currentRole = "parent"
+  }
+
+  const allNavItems = NAV_CONFIG[currentRole] ?? NAV_CONFIG.teacher
+
+  // Filter nav items by permission
+  const navItems = allNavItems.filter((item) => {
+    if (!item.permission) return true
+    return permissions.includes(item.permission as Permission)
+  }).map((item) => ({
+    ...item,
+    items: item.items?.filter((subItem) => {
+      if (!subItem.permission) return true
+      return permissions.includes(subItem.permission as Permission)
+    }),
+  }))
 
   // Ensure consistent state for hydration
   if (!expanded && mode === 'mobile') return null 

src/modules/layout/config/navigation.ts

@@ -15,12 +15,14 @@ import {
   Briefcase
 } from "lucide-react"
 import type { LucideIcon } from "lucide-react"
+import { Permissions } from "@/shared/types/permissions"
 
 export type NavItem = {
   title: string
   icon: LucideIcon
   href: string
-  items?: { title: string; href: string }[]
+  permission?: string
+  items?: { title: string; href: string; permission?: string }[]
 }
 
 export type Role = "admin" | "teacher" | "student" | "parent"
@@ -31,11 +33,13 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "Dashboard",
       icon: LayoutDashboard,
       href: "/admin/dashboard",
+      permission: Permissions.SCHOOL_MANAGE,
     },
     {
       title: "School Management",
       icon: Shield,
       href: "/admin/school",
+      permission: Permissions.SCHOOL_MANAGE,
       items: [
         { title: "Schools", href: "/admin/school/schools" },
         { title: "Grades", href: "/admin/school/grades" },
@@ -49,6 +53,7 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "Users",
       icon: Users,
       href: "/admin/users",
+      permission: Permissions.USER_MANAGE,
       items: [
         { title: "Teachers", href: "/admin/users/teachers" },
         { title: "Students", href: "/admin/users/students" },
@@ -79,6 +84,7 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "Settings",
       icon: Settings,
       href: "/settings",
+      permission: Permissions.SETTINGS_ADMIN,
     },
   ],
   teacher: [
@@ -91,20 +97,23 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "Textbooks",
       icon: Library,
       href: "/teacher/textbooks",
+      permission: Permissions.TEXTBOOK_READ,
     },
     {
       title: "Exams",
       icon: FileQuestion,
       href: "/teacher/exams",
+      permission: Permissions.EXAM_CREATE,
       items: [
         { title: "All Exams", href: "/teacher/exams/all" },
-        { title: "Create Exam", href: "/teacher/exams/create" },
+        { title: "Create Exam", href: "/teacher/exams/create", permission: Permissions.EXAM_CREATE },
       ]
     },
     {
       title: "Homework",
       icon: PenTool,
       href: "/teacher/homework",
+      permission: Permissions.HOMEWORK_CREATE,
       items: [
         { title: "Assignments", href: "/teacher/homework/assignments" },
         { title: "Submissions", href: "/teacher/homework/submissions" },
@@ -114,21 +123,24 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "Question Bank",
       icon: ClipboardList,
       href: "/teacher/questions",
+      permission: Permissions.QUESTION_READ,
     },
     {
       title: "Class Management",
       icon: Users,
       href: "/teacher/classes",
+      permission: Permissions.CLASS_READ,
       items: [
         { title: "My Classes", href: "/teacher/classes/my" },
         { title: "Students", href: "/teacher/classes/students" },
-        { title: "Schedule", href: "/teacher/classes/schedule" },
+        { title: "Schedule", href: "/teacher/classes/schedule", permission: Permissions.CLASS_SCHEDULE },
       ]
     },
     {
       title: "Management",
       icon: Briefcase,
       href: "/management",
+      permission: Permissions.GRADE_MANAGE,
       items: [
         { title: "Grade Insights", href: "/management/grade/insights" },
       ]
@@ -144,16 +156,18 @@ export const NAV_CONFIG: Record<Role, NavItem[]> = {
       title: "My Learning",
       icon: BookOpen,
       href: "/student/learning",
+      permission: Permissions.HOMEWORK_SUBMIT,
       items: [
         { title: "Courses", href: "/student/learning/courses" },
-        { title: "Assignments", href: "/student/learning/assignments" },
-        { title: "Textbooks", href: "/student/learning/textbooks" },
+        { title: "Assignments", href: "/student/learning/assignments", permission: Permissions.HOMEWORK_SUBMIT },
+        { title: "Textbooks", href: "/student/learning/textbooks", permission: Permissions.TEXTBOOK_READ },
       ]
     },
     {
       title: "Schedule",
       icon: Calendar,
       href: "/student/schedule",
+      permission: Permissions.CLASS_SCHEDULE,
     },
   ],
   parent: [