feat(app): add error/loading boundaries across all dashboard routes and new routes

- Add error.tsx and loading.tsx boundaries for admin, parent, student, teacher routes

- Add admin announcements edit, audit-logs overview, curriculum-map, invitation-codes, permissions, questions, roles routes

- Add admin elective detail and components, files, course-plans, users, scheduling boundaries

- Add messages group-compose route

- Add parent course-plans, elective, grades report-card, practice routes

- Add student course-plans, elective detail, error-book dialogs, grades report-card, learning study-path, leave, schedule boundaries

- Add teacher attendance report, classes boundaries, course-plans boundaries, elective, exams analytics/edit-rich/all/create/new, grades report-card, homework boundaries, leave, lesson-plans calendar

- Add auth loading, onboarding loading, api cron

src/app/(onboarding)/loading.tsx

@@ -0,0 +1,42 @@
+/**
+ * Onboarding 路由组 loading.tsx（audit-P1-5 新增）
+ *
+ * 在 onboarding 页面服务端渲染期间（getAuthContext + getOnboardingStatus
+ * 数据库查询）展示的骨架屏，匹配 onboarding/page.tsx 的卡片布局与 stepper 结构。
+ */
+export default function OnboardingRouteLoading() {
+  return (
+    <main className="flex min-h-screen items-center justify-center bg-muted/30 p-4">
+      <div className="w-full max-w-2xl rounded-lg border bg-background p-8 shadow-sm">
+        <div className="grid gap-6" aria-busy="true" aria-live="polite">
+          {/* 标题与描述 */}
+          <div className="grid gap-1.5">
+            <div className="h-7 w-40 animate-pulse rounded bg-muted" />
+            <div className="h-4 w-64 animate-pulse rounded bg-muted" />
+          </div>
+
+          {/* 进度条 */}
+          <div className="flex items-center gap-2">
+            <div className="h-1 flex-1 rounded bg-muted" />
+            <div className="h-1 flex-1 rounded bg-muted" />
+            <div className="h-1 flex-1 rounded bg-muted" />
+            <div className="h-1 flex-1 rounded bg-muted" />
+          </div>
+
+          {/* 表单字段骨架 */}
+          <div className="grid gap-4">
+            <div className="h-10 animate-pulse rounded bg-muted" />
+            <div className="h-10 animate-pulse rounded bg-muted" />
+            <div className="h-10 animate-pulse rounded bg-muted" />
+          </div>
+
+          {/* 按钮骨架 */}
+          <div className="flex justify-between">
+            <div className="h-10 w-24 animate-pulse rounded bg-muted" />
+            <div className="h-10 w-24 animate-pulse rounded bg-muted" />
+          </div>
+        </div>
+      </div>
+    </main>
+  )
+}

src/app/(onboarding)/onboarding/page.tsx

@@ -3,7 +3,8 @@ import { redirect } from "next/navigation"
 import type { Metadata } from "next"
 import { getTranslations } from "next-intl/server"
 
-import { auth } from "@/auth"
+import { getAuthContext } from "@/shared/lib/auth-guard"
+import { PermissionDeniedError } from "@/shared/lib/errors"
 import { getOnboardingStatus } from "@/modules/onboarding/data-access"
 import { OnboardingStepper } from "@/modules/onboarding/components/onboarding-stepper"
 
@@ -16,21 +17,21 @@ export async function generateMetadata(): Promise<Metadata> {
 }
 
 export default async function OnboardingPage() {
-  const session = await auth()
-  const userId = session?.user?.id
-
-  if (!userId) {
-    redirect("/login")
+  // P0-3 修复：使用 getAuthContext() 替代直接 import @/auth
+  // getAuthContext() 在未认证时抛出 PermissionDeniedError，捕获后重定向到 /login
+  let ctx
+  try {
+    ctx = await getAuthContext()
+  } catch (e) {
+    if (e instanceof PermissionDeniedError) {
+      redirect("/login")
+    }
+    throw e
   }
 
-  // 已完成 onboarding 的用户不应停留在此页
-  if (session.user.onboarded) {
-    redirect("/dashboard")
-  }
-
-  const status = await getOnboardingStatus(userId)
-
-  // 二次校验：DB 层面已 onboarded 但 session 未刷新
+  // 数据库是 onboarding 状态的唯一真相源
+  // （原 session.user.onboarded 检查冗余，DB 查询更准确）
+  const status = await getOnboardingStatus(ctx.userId)
   if (!status.required) {
     redirect("/dashboard")
   }