feat(app): add error/loading boundaries across all dashboard routes and new routes

- Add error.tsx and loading.tsx boundaries for admin, parent, student, teacher routes

- Add admin announcements edit, audit-logs overview, curriculum-map, invitation-codes, permissions, questions, roles routes

- Add admin elective detail and components, files, course-plans, users, scheduling boundaries

- Add messages group-compose route

- Add parent course-plans, elective, grades report-card, practice routes

- Add student course-plans, elective detail, error-book dialogs, grades report-card, learning study-path, leave, schedule boundaries

- Add teacher attendance report, classes boundaries, course-plans boundaries, elective, exams analytics/edit-rich/all/create/new, grades report-card, homework boundaries, leave, lesson-plans calendar

- Add auth loading, onboarding loading, api cron

src/app/(onboarding)/onboarding/page.tsx

@@ -3,7 +3,8 @@ import { redirect } from "next/navigation"
 import type { Metadata } from "next"
 import { getTranslations } from "next-intl/server"
 
-import { auth } from "@/auth"
+import { getAuthContext } from "@/shared/lib/auth-guard"
+import { PermissionDeniedError } from "@/shared/lib/errors"
 import { getOnboardingStatus } from "@/modules/onboarding/data-access"
 import { OnboardingStepper } from "@/modules/onboarding/components/onboarding-stepper"
 
@@ -16,21 +17,21 @@ export async function generateMetadata(): Promise<Metadata> {
 }
 
 export default async function OnboardingPage() {
-  const session = await auth()
-  const userId = session?.user?.id
-
-  if (!userId) {
-    redirect("/login")
+  // P0-3 修复：使用 getAuthContext() 替代直接 import @/auth
+  // getAuthContext() 在未认证时抛出 PermissionDeniedError，捕获后重定向到 /login
+  let ctx
+  try {
+    ctx = await getAuthContext()
+  } catch (e) {
+    if (e instanceof PermissionDeniedError) {
+      redirect("/login")
+    }
+    throw e
   }
 
-  // 已完成 onboarding 的用户不应停留在此页
-  if (session.user.onboarded) {
-    redirect("/dashboard")
-  }
-
-  const status = await getOnboardingStatus(userId)
-
-  // 二次校验：DB 层面已 onboarded 但 session 未刷新
+  // 数据库是 onboarding 状态的唯一真相源
+  // （原 session.user.onboarded 检查冗余，DB 查询更准确）
+  const status = await getOnboardingStatus(ctx.userId)
   if (!status.required) {
     redirect("/dashboard")
   }