feat: 完成 P1 全部功能 + 修复 proxy 导出 + 切换 MySQL 端口至 14013

## P1 功能（20 项）
- 站内消息系统、家长仪表盘、学生考勤管理
- Excel 导入导出、用户批量导入、成绩导出
- 排课规则+自动排课+课表调整
- 成绩趋势+对比分析、密码安全策略、速率限制
- 数据变更日志、文件预览+存储策略、全文检索
- 依赖审计集成 CI、数据库定时备份、E2E 测试完善
- 通知偏好管理

## 基础设施修复
- src/proxy.ts: 将 middleware 导出重命名为 proxy（Next.js 16 要求）
- .env: MySQL 端口从 13002 切换至 14013
- scripts/create-db.ts: 新增数据库初始化脚本

## 架构文档同步
- 004_architecture_impact_map.md 和 005_architecture_data.json
  完整记录所有新增表、模块、路由、权限、依赖关系

src/modules/settings/actions.ts

@@ -5,10 +5,11 @@ import { revalidatePath } from "next/cache"
 import { createId } from "@paralleldrive/cuid2"
 import { count, desc, eq } from "drizzle-orm"
 
-import { auth } from "@/auth"
 import { db } from "@/shared/db"
 import { aiProviders } from "@/shared/db/schema"
 import type { ActionState } from "@/shared/types/action-state"
+import { requirePermission, PermissionDeniedError } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
 import { encryptAiApiKey, getAiErrorMessage, testAiProviderById, testAiProviderConfig } from "@/shared/lib/ai"
 
 const ProviderSchema = z.enum(["zhipu", "openai", "gemini", "custom"])
@@ -45,10 +46,8 @@ export type AiProviderSummary = {
 }
 
 const ensureUser = async () => {
-  const session = await auth()
-  const userId = String(session?.user?.id ?? "").trim()
-  if (!userId) throw new Error("Unauthorized")
-  return { id: userId }
+  const ctx = await requirePermission(Permissions.AI_CONFIGURE)
+  return { id: ctx.userId }
 }
 
 const normalizeBaseUrl = (value: string | undefined) => {
@@ -171,7 +170,8 @@ export async function upsertAiProviderAction(
 
     revalidatePath("/settings")
     return { success: true, message: "AI provider created", data: id }
-  } catch {
+  } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     return { success: false, message: "Failed to save AI provider" }
   }
 }
@@ -199,6 +199,7 @@ export async function testAiProviderAction(
     }
     return { success: true, message: "AI connection ok", data: null }
   } catch (error) {
+    if (error instanceof PermissionDeniedError) return { success: false, message: error.message }
     return { success: false, message: getAiErrorMessage(error) }
   }
 }