feat: 完成 P1 全部功能 + 修复 proxy 导出 + 切换 MySQL 端口至 14013

## P1 功能（20 项）
- 站内消息系统、家长仪表盘、学生考勤管理
- Excel 导入导出、用户批量导入、成绩导出
- 排课规则+自动排课+课表调整
- 成绩趋势+对比分析、密码安全策略、速率限制
- 数据变更日志、文件预览+存储策略、全文检索
- 依赖审计集成 CI、数据库定时备份、E2E 测试完善
- 通知偏好管理

## 基础设施修复
- src/proxy.ts: 将 middleware 导出重命名为 proxy（Next.js 16 要求）
- .env: MySQL 端口从 13002 切换至 14013
- scripts/create-db.ts: 新增数据库初始化脚本

## 架构文档同步
- 004_architecture_impact_map.md 和 005_architecture_data.json
  完整记录所有新增表、模块、路由、权限、依赖关系

src/app/(dashboard)/settings/page.tsx

@@ -5,6 +5,7 @@ import { AdminSettingsView } from "@/modules/settings/components/admin-settings-
 import { StudentSettingsView } from "@/modules/settings/components/student-settings-view"
 import { TeacherSettingsView } from "@/modules/settings/components/teacher-settings-view"
 import { getUserProfile } from "@/modules/users/data-access"
+import { getNotificationPreferences } from "@/modules/messaging/notification-preferences"
 import { Permissions } from "@/shared/types/permissions"
 
 export const dynamic = "force-dynamic"
@@ -19,8 +20,13 @@ export default async function SettingsPage() {
   if (!userProfile) redirect("/login")
 
   const permissions = session.user.permissions ?? []
+  const notificationPrefs = await getNotificationPreferences(userId)
 
-  if (permissions.includes(Permissions.SETTINGS_ADMIN)) return <AdminSettingsView user={userProfile} />
-  if (permissions.includes(Permissions.HOMEWORK_SUBMIT) && !permissions.includes(Permissions.EXAM_CREATE)) return <StudentSettingsView user={userProfile} />
-  return <TeacherSettingsView user={userProfile} />
+  if (permissions.includes(Permissions.SETTINGS_ADMIN)) {
+    return <AdminSettingsView user={userProfile} notificationPreferences={notificationPrefs} />
+  }
+  if (permissions.includes(Permissions.HOMEWORK_SUBMIT) && !permissions.includes(Permissions.EXAM_CREATE)) {
+    return <StudentSettingsView user={userProfile} notificationPreferences={notificationPrefs} />
+  }
+  return <TeacherSettingsView user={userProfile} notificationPreferences={notificationPrefs} />
 }

src/app/(dashboard)/settings/security/page.tsx

@@ -0,0 +1,50 @@
+import { redirect } from "next/navigation"
+import { Lock } from "lucide-react"
+
+import { auth } from "@/auth"
+import { PasswordChangeForm } from "@/modules/settings/components/password-change-form"
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/shared/components/ui/card"
+
+export const dynamic = "force-dynamic"
+
+export const metadata = {
+  title: "Security Settings",
+}
+
+export default async function SecuritySettingsPage() {
+  const session = await auth()
+  if (!session?.user) redirect("/login")
+
+  return (
+    <div className="flex h-full flex-col gap-8 p-8">
+      <div className="space-y-1">
+        <div className="flex items-center gap-2">
+          <Lock className="h-7 w-7 text-muted-foreground" />
+          <h1 className="text-3xl font-bold tracking-tight">Security</h1>
+        </div>
+        <div className="text-sm text-muted-foreground">
+          Manage your password and account security settings.
+        </div>
+      </div>
+
+      <div className="max-w-2xl space-y-6">
+        <PasswordChangeForm />
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Security Tips</CardTitle>
+            <CardDescription>Best practices to keep your account safe.</CardDescription>
+          </CardHeader>
+          <CardContent>
+            <ul className="space-y-2 text-sm text-muted-foreground">
+              <li>Use a unique password that you don&apos;t reuse across other sites.</li>
+              <li>Avoid common words, names, or sequential patterns.</li>
+              <li>Change your password periodically.</li>
+              <li>Your account will be temporarily locked after multiple failed login attempts.</li>
+            </ul>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  )
+}