feat(app): add error/loading boundaries and update dashboard routes

- Add error.tsx and loading.tsx boundaries for admin, parent, student, teacher routes

- Add dashboard-error-fallback and dashboard-loading-skeleton components

- Add student/learning page, parent/leave routes, teacher textbook components

- Update existing app routes across auth, dashboard, and API endpoints

- Update proxy middleware and next-auth type declarations

src/app/(dashboard)/student/diagnostic/error.tsx

@@ -0,0 +1,27 @@
+"use client"
+
+import { AlertCircle } from "lucide-react"
+
+import { EmptyState } from "@/shared/components/ui/empty-state"
+
+export default function StudentDiagnosticError({
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  return (
+    <div className="flex h-full flex-col items-center justify-center space-y-4 p-8">
+      <EmptyState
+        icon={AlertCircle}
+        title="学情诊断页面加载失败"
+        description="抱歉，页面加载时发生了意外错误。请稍后重试。"
+        action={{
+          label: "重试",
+          onClick: () => reset(),
+        }}
+        className="border-none shadow-none h-auto"
+      />
+    </div>
+  )
+}

src/app/(dashboard)/student/diagnostic/page.tsx

@@ -1,5 +1,6 @@
 import { Stethoscope } from "lucide-react"
-import { getAuthContext } from "@/shared/lib/auth-guard"
+import { requirePermission } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
 import { getStudentMasterySummary } from "@/modules/diagnostic/data-access"
 import { getDiagnosticReports } from "@/modules/diagnostic/data-access-reports"
 import { StudentDiagnosticView } from "@/modules/diagnostic/components/student-diagnostic-view"
@@ -7,15 +8,20 @@ import { StudentDiagnosticView } from "@/modules/diagnostic/components/student-d
 export const dynamic = "force-dynamic"
 
 export default async function StudentDiagnosticPage() {
-  const ctx = await getAuthContext()
+  const ctx = await requirePermission(Permissions.DIAGNOSTIC_READ)
 
-  const [summary, reports] = await Promise.all([
+  const [summary, reportsResult] = await Promise.all([
     getStudentMasterySummary(ctx.userId),
-    getDiagnosticReports({ studentId: ctx.userId }),
+    // v4-P1-3: 学生仅可见已发布报告，避免草稿泄露
+    getDiagnosticReports(
+      { studentId: ctx.userId, status: "published" },
+      ctx.dataScope,
+    ),
   ])
+  const reports = reportsResult.reports
 
   return (
-    <div className="h-full flex-1 flex-col space-y-8 p-8 md:flex">
+    <div className="space-y-8">
       <div>
         <h2 className="flex items-center gap-2 text-2xl font-bold tracking-tight">
           <Stethoscope className="h-6 w-6" />