refactor: fix all P0/P1/P2 bugs and architecture issues

Bug fixes (from bugs/ directory):

- Fix cross-module DB queries in 9 modules (homework, grades, parent, diagnostic, elective, proctoring, notifications, scheduling, classes) by routing through data-access functions

- Fix shared/lib <-> auth circular dependency via new session.ts module

- Fix divide-by-zero guard in grades data-access

- Fix audit export data truncation (paginated fetch for full datasets)

- Fix missing transactions in homework grading and elective lottery

- Fix missing revalidatePath in course-plans actions

- Fix frontend permission checks using requirePermission instead of requireAuth

- Fix dashboard role routing using session.user.roles

- Fix student auth pattern (migrate getDemoStudentUser to users module)

- Fix ActionState return type handling in components

Code quality fixes:

- Remove 60+ as type assertions (replace with type guards)

- Remove non-null assertions (use optional chaining or explicit checks)

- Convert dynamic imports to static imports (grades, diagnostic)

- Add React.cache() wrapping for read functions

- Parallelize independent queries with Promise.all

- Add explicit return types to 30+ arrow functions

- Replace any with unknown + type guards

- Fix import type for type-only imports

- Add Zod validation schemas for classes and diagnostic modules

- Extract duplicate code (normalizeRoleName, normalizeBcryptHash, logger IP extraction)

- Add console.error to silent catch blocks

- Fix permission naming consistency (exam:proctor_read -> exam:proctor:read)

Architecture doc sync:

- Update 004_architecture_impact_map.md and 005_architecture_data.json

- Update management-modules-audit.md for P0-7 cross-module fix

Moved deleted proctoring event route to deletes/ folder.

src/modules/announcements/actions.ts

@@ -3,7 +3,7 @@
 import { revalidatePath } from "next/cache"
 import { createId } from "@paralleldrive/cuid2"
 
-import { requireAuth, requirePermission, PermissionDeniedError } from "@/shared/lib/auth-guard"
+import { requirePermission, PermissionDeniedError } from "@/shared/lib/auth-guard"
 import { Permissions } from "@/shared/types/permissions"
 import type { ActionState } from "@/shared/types/action-state"
 
@@ -218,7 +218,7 @@ export async function getAnnouncementsAction(
   params?: GetAnnouncementsParams
 ): Promise<ActionState<Announcement[]>> {
   try {
-    await requireAuth()
+    await requirePermission(Permissions.ANNOUNCEMENT_READ)
     const data = await getAnnouncements(params)
     return { success: true, data }
   } catch (e) {

src/modules/announcements/data-access.ts

@@ -8,8 +8,6 @@ import { announcements, users } from "@/shared/db/schema"
 import type {
   Announcement,
   AnnouncementInsertData,
-  AnnouncementStatus,
-  AnnouncementType,
   AnnouncementUpdateData,
   GetAnnouncementsParams,
 } from "./types"
@@ -17,6 +15,8 @@ import type {
 const toIso = (d: Date | null | undefined): string | null =>
   d ? d.toISOString() : null
 
+const toIsoRequired = (d: Date): string => d.toISOString()
+
 const mapRow = (
   row: {
     id: string
@@ -43,8 +43,8 @@ const mapRow = (
   authorId: row.authorId,
   authorName: row.authorName,
   publishedAt: toIso(row.publishedAt),
-  createdAt: toIso(row.createdAt) as string,
-  updatedAt: toIso(row.updatedAt) as string,
+  createdAt: toIsoRequired(row.createdAt),
+  updatedAt: toIsoRequired(row.updatedAt),
 })
 
 export const getAnnouncements = cache(
@@ -56,10 +56,10 @@ export const getAnnouncements = cache(
 
       const conditions = []
       if (params?.status) {
-        conditions.push(eq(announcements.status, params.status as AnnouncementStatus))
+        conditions.push(eq(announcements.status, params.status))
       }
       if (params?.type) {
-        conditions.push(eq(announcements.type, params.type as AnnouncementType))
+        conditions.push(eq(announcements.type, params.type))
       }
 
       const rows = await db
@@ -85,7 +85,8 @@ export const getAnnouncements = cache(
         .offset(offset)
 
       return rows.map(mapRow)
-    } catch {
+    } catch (error) {
+      console.error("getAnnouncements failed:", error)
       return []
     }
   }
@@ -115,7 +116,8 @@ export const getAnnouncementById = cache(
         .limit(1)
 
       return row ? mapRow(row) : null
-    } catch {
+    } catch (error) {
+      console.error("getAnnouncementById failed:", error)
       return null
     }
   }