feat: 完成 P1 全部功能 + 修复 proxy 导出 + 切换 MySQL 端口至 14013

## P1 功能（20 项）
- 站内消息系统、家长仪表盘、学生考勤管理
- Excel 导入导出、用户批量导入、成绩导出
- 排课规则+自动排课+课表调整
- 成绩趋势+对比分析、密码安全策略、速率限制
- 数据变更日志、文件预览+存储策略、全文检索
- 依赖审计集成 CI、数据库定时备份、E2E 测试完善
- 通知偏好管理

## 基础设施修复
- src/proxy.ts: 将 middleware 导出重命名为 proxy（Next.js 16 要求）
- .env: MySQL 端口从 13002 切换至 14013
- scripts/create-db.ts: 新增数据库初始化脚本

## 架构文档同步
- 004_architecture_impact_map.md 和 005_architecture_data.json
  完整记录所有新增表、模块、路由、权限、依赖关系

src/modules/school/actions.ts

@@ -7,6 +7,9 @@ import { eq } from "drizzle-orm"
 import { db } from "@/shared/db"
 import { academicYears, departments, grades, schools } from "@/shared/db/schema"
 import type { ActionState } from "@/shared/types/action-state"
+import { requirePermission, PermissionDeniedError } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
+import { logAudit } from "@/shared/lib/audit-logger"
 import { UpsertAcademicYearSchema, UpsertDepartmentSchema, UpsertGradeSchema, UpsertSchoolSchema } from "./schema"
 
 export async function createDepartmentAction(
@@ -14,6 +17,7 @@ export async function createDepartmentAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertDepartmentSchema.parse({
       name: formData.get("name"),
       description: formData.get("description"),
@@ -28,6 +32,7 @@ export async function createDepartmentAction(
     revalidatePath("/admin/school/departments")
     return { success: true, message: "Department created" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to create department" }
   }
@@ -39,6 +44,7 @@ export async function updateDepartmentAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertDepartmentSchema.parse({
       name: formData.get("name"),
       description: formData.get("description"),
@@ -55,6 +61,7 @@ export async function updateDepartmentAction(
     revalidatePath("/admin/school/departments")
     return { success: true, message: "Department updated" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to update department" }
   }
@@ -62,10 +69,12 @@ export async function updateDepartmentAction(
 
 export async function deleteDepartmentAction(departmentId: string): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     await db.delete(departments).where(eq(departments.id, departmentId))
     revalidatePath("/admin/school/departments")
     return { success: true, message: "Department deleted" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to delete department" }
   }
@@ -76,6 +85,7 @@ export async function createAcademicYearAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertAcademicYearSchema.parse({
       name: formData.get("name"),
       startDate: formData.get("startDate"),
@@ -100,6 +110,7 @@ export async function createAcademicYearAction(
     revalidatePath("/admin/school/academic-year")
     return { success: true, message: "Academic year created" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to create academic year" }
   }
@@ -111,6 +122,7 @@ export async function updateAcademicYearAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertAcademicYearSchema.parse({
       name: formData.get("name"),
       startDate: formData.get("startDate"),
@@ -137,6 +149,7 @@ export async function updateAcademicYearAction(
     revalidatePath("/admin/school/academic-year")
     return { success: true, message: "Academic year updated" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to update academic year" }
   }
@@ -144,10 +157,12 @@ export async function updateAcademicYearAction(
 
 export async function deleteAcademicYearAction(academicYearId: string): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     await db.delete(academicYears).where(eq(academicYears.id, academicYearId))
     revalidatePath("/admin/school/academic-year")
     return { success: true, message: "Academic year deleted" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to delete academic year" }
   }
@@ -158,6 +173,7 @@ export async function createSchoolAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertSchoolSchema.parse({
       name: formData.get("name"),
       code: formData.get("code"),
@@ -169,9 +185,12 @@ export async function createSchoolAction(
       code: parsed.code?.trim() ? parsed.code.trim() : null,
     })
 
+    await logAudit({ action: "school.create", module: "school", targetType: "school", detail: { name: parsed.name } })
+
     revalidatePath("/admin/school/schools")
     return { success: true, message: "School created" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to create school" }
   }
@@ -183,6 +202,7 @@ export async function updateSchoolAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     const parsed = UpsertSchoolSchema.parse({
       name: formData.get("name"),
       code: formData.get("code"),
@@ -196,9 +216,12 @@ export async function updateSchoolAction(
       })
       .where(eq(schools.id, schoolId))
 
+    await logAudit({ action: "school.update", module: "school", targetId: schoolId, targetType: "school", detail: { name: parsed.name } })
+
     revalidatePath("/admin/school/schools")
     return { success: true, message: "School updated" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to update school" }
   }
@@ -206,11 +229,16 @@ export async function updateSchoolAction(
 
 export async function deleteSchoolAction(schoolId: string): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.SCHOOL_MANAGE)
     await db.delete(schools).where(eq(schools.id, schoolId))
+
+    await logAudit({ action: "school.delete", module: "school", targetId: schoolId, targetType: "school" })
+
     revalidatePath("/admin/school/schools")
     revalidatePath("/admin/school/grades")
     return { success: true, message: "School deleted" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to delete school" }
   }
@@ -221,6 +249,7 @@ export async function createGradeAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.GRADE_MANAGE)
     const parsed = UpsertGradeSchema.parse({
       schoolId: formData.get("schoolId"),
       name: formData.get("name"),
@@ -241,6 +270,7 @@ export async function createGradeAction(
     revalidatePath("/admin/school/grades")
     return { success: true, message: "Grade created" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to create grade" }
   }
@@ -252,6 +282,7 @@ export async function updateGradeAction(
   formData: FormData
 ): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.GRADE_MANAGE)
     const parsed = UpsertGradeSchema.parse({
       schoolId: formData.get("schoolId"),
       name: formData.get("name"),
@@ -274,6 +305,7 @@ export async function updateGradeAction(
     revalidatePath("/admin/school/grades")
     return { success: true, message: "Grade updated" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to update grade" }
   }
@@ -281,10 +313,12 @@ export async function updateGradeAction(
 
 export async function deleteGradeAction(gradeId: string): Promise<ActionState<string>> {
   try {
+    await requirePermission(Permissions.GRADE_MANAGE)
     await db.delete(grades).where(eq(grades.id, gradeId))
     revalidatePath("/admin/school/grades")
     return { success: true, message: "Grade deleted" }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     if (error instanceof Error) return { success: false, message: error.message }
     return { success: false, message: "Failed to delete grade" }
   }