feat: 完成 P1 全部功能 + 修复 proxy 导出 + 切换 MySQL 端口至 14013

## P1 功能（20 项）
- 站内消息系统、家长仪表盘、学生考勤管理
- Excel 导入导出、用户批量导入、成绩导出
- 排课规则+自动排课+课表调整
- 成绩趋势+对比分析、密码安全策略、速率限制
- 数据变更日志、文件预览+存储策略、全文检索
- 依赖审计集成 CI、数据库定时备份、E2E 测试完善
- 通知偏好管理

## 基础设施修复
- src/proxy.ts: 将 middleware 导出重命名为 proxy（Next.js 16 要求）
- .env: MySQL 端口从 13002 切换至 14013
- scripts/create-db.ts: 新增数据库初始化脚本

## 架构文档同步
- 004_architecture_impact_map.md 和 005_architecture_data.json
  完整记录所有新增表、模块、路由、权限、依赖关系

src/app/(dashboard)/messages/[id]/page.tsx

@@ -0,0 +1,30 @@
+import { notFound } from "next/navigation"
+import { requirePermission } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
+import { getMessageById, markMessageAsRead } from "@/modules/messaging/data-access"
+import { MessageDetail } from "@/modules/messaging/components/message-detail"
+
+export const dynamic = "force-dynamic"
+
+export default async function MessageDetailPage({
+  params,
+}: {
+  params: Promise<{ id: string }>
+}) {
+  const ctx = await requirePermission(Permissions.MESSAGE_READ)
+  const { id } = await params
+
+  const message = await getMessageById(id, ctx.userId)
+  if (!message) notFound()
+
+  // Auto-mark as read when viewed by the receiver
+  if (!message.isRead && message.receiverId === ctx.userId) {
+    await markMessageAsRead(id, ctx.userId)
+  }
+
+  return (
+    <div className="flex h-full flex-col p-8">
+      <MessageDetail message={message} currentUserId={ctx.userId} />
+    </div>
+  )
+}

src/app/(dashboard)/messages/compose/page.tsx

@@ -0,0 +1,34 @@
+import { requirePermission } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
+import { getRecipients } from "@/modules/messaging/data-access"
+import { MessageCompose } from "@/modules/messaging/components/message-compose"
+
+export const dynamic = "force-dynamic"
+
+export default async function ComposeMessagePage({
+  searchParams,
+}: {
+  searchParams: Promise<{ parentId?: string; receiverId?: string; subject?: string }>
+}) {
+  const ctx = await requirePermission(Permissions.MESSAGE_SEND)
+  const sp = await searchParams
+
+  const recipients = await getRecipients(ctx.userId, ctx.dataScope)
+
+  return (
+    <div className="flex h-full flex-col p-8">
+      <div className="mx-auto w-full max-w-3xl space-y-6">
+        <div>
+          <h2 className="text-2xl font-bold tracking-tight">Compose Message</h2>
+          <p className="text-muted-foreground">Send a message to another user.</p>
+        </div>
+        <MessageCompose
+          recipients={recipients}
+          parentMessageId={sp.parentId}
+          defaultReceiverId={sp.receiverId}
+          defaultSubject={sp.subject}
+        />
+      </div>
+    </div>
+  )
+}

src/app/(dashboard)/messages/page.tsx

@@ -0,0 +1,31 @@
+import { requirePermission } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
+import { getMessages, getNotifications } from "@/modules/messaging/data-access"
+import { MessageList } from "@/modules/messaging/components/message-list"
+import { NotificationList } from "@/modules/messaging/components/notification-list"
+
+export const dynamic = "force-dynamic"
+
+export default async function MessagesPage() {
+  const ctx = await requirePermission(Permissions.MESSAGE_READ)
+
+  const [messagesResult, notificationsResult] = await Promise.all([
+    getMessages({ userId: ctx.userId, type: "all", page: 1, pageSize: 50 }),
+    getNotifications(ctx.userId, { page: 1, pageSize: 20 }),
+  ])
+
+  return (
+    <div className="flex h-full flex-col space-y-8 p-8">
+      <div>
+        <h2 className="text-2xl font-bold tracking-tight">Messages</h2>
+        <p className="text-muted-foreground">
+          Manage your inbox and stay updated with notifications.
+        </p>
+      </div>
+
+      <MessageList messages={messagesResult.items} currentUserId={ctx.userId} />
+
+      <NotificationList notifications={notificationsResult.items} />
+    </div>
+  )
+}