feat(textbooks): 教材模块审计重构 — 跨模块解耦 + 权限 + i18n + 错误边界 + 纯函数抽取

P0 修复：
- 解耦跨模块 UI 依赖：knowledge-point-dialogs 不再直接 import questions，
  改为 renderQuestionCreator render prop 由页面注入
- 接入 usePermission Hook 替换 canEdit 硬编码
- 全模块 i18n 改造：新增 en/zh-CN 翻译文件，替换所有硬编码文案
- Server Action 资源归属校验：新增 verifyChapterBelongsToTextbook/
  verifyKnowledgePointBelongsToTextbook，在 reorder/update/delete/create 中校验

P1 改进：
- 补齐 Error Boundary：4 个 error.tsx + TextbookSectionErrorBoundary 区块包裹
- 抽取纯函数到 utils.ts/graph-layout.ts/constants.ts 并补单测（26 用例全通过）
- 消除重复组件：删除 knowledge-point-panel/create-knowledge-point-dialog
- 修复类型断言：chapter.children! → 守卫式访问
- 图谱 a11y：添加 role/aria-label/aria-pressed
- 统一删除确认：confirm() → AlertDialog
- 数据范围过滤：getTextbooksWithScope 支持学生端按年级过滤

P2 预留：
- TextbookAnalytics 埋点接口 + Provider + Hook

同步 005 架构数据 JSON：补充 getTextbooksWithScope/verify*/ChapterTreeNode 等

src/modules/users/data-access.ts

@@ -212,7 +212,7 @@ export const getUserWithRole = cache(
  * session and verifying the "student" role via JOIN users + usersToRoles + roles.
  * Returns null if not authenticated or the user does not have the student role.
  */
-export const getCurrentStudentUser = cache(async (): Promise<{ id: string; name: string } | null> => {
+export const getCurrentStudentUser = cache(async (): Promise<{ id: string; name: string; gradeId: string | null } | null> => {
   const session = await auth()
   const userId = String(session?.user?.id ?? "").trim()
   if (!userId) return null
@@ -220,7 +220,15 @@ export const getCurrentStudentUser = cache(async (): Promise<{ id: string; name:
   const student = await getUserWithRole(userId, "student")
 
   if (!student) return null
-  return { id: student.id, name: student.name || "Student" }
+
+  // 查询学生的 gradeId（关联 grades 表）
+  const [userRow] = await db
+    .select({ gradeId: users.gradeId })
+    .from(users)
+    .where(eq(users.id, student.id))
+    .limit(1)
+
+  return { id: student.id, name: student.name || "Student", gradeId: userRow?.gradeId ?? null }
 })
 
 /** Returns a map of userId -> { name, email } for the given user ids. */