refactor(grades,diagnostic): 完成成绩和学情诊断模块审计 P1+P2 改进项

P1-1: 抽取 stats-service.ts，将 8 个统计计算纯函数从 data-access 层分离
P1-5: 创建 WidgetBoundary 组件 + 补齐 teacher 路由 loading.tsx/error.tsx (14 文件)
P1-6: 同步架构图文档 004/005，新增 stats-service 与 widget-boundary 节点
P2-1: 补充 a11y ARIA 属性（5 图表 role=img + aria-label，2 表格 caption，3 列表 role=list，3 按钮 aria-label）
P2-3: 修复班级报告 studentId 字段语义错误（schema 改为可空 + 迁移 + 代码适配）
P2-4: 修复 grade_managed scope 返回空数据（改为子查询 classes 表按 gradeId 过滤）
P2-5: 新增 /parent/diagnostic/ 页面（多子女学情诊断聚合 + loading + error）
P2-6: 统一 SearchParams 工具（student/grades 和 management/grade/insights 改用 @/shared/lib/search-params）

src/app/(dashboard)/student/grades/page.tsx

@@ -1,26 +1,21 @@
-import { getAuthContext } from "@/shared/lib/auth-guard"
+import { requirePermission } from "@/shared/lib/auth-guard"
+import { Permissions } from "@/shared/types/permissions"
 import { getStudentGradeSummary } from "@/modules/grades/data-access"
 import { StudentGradeSummary } from "@/modules/grades/components/student-grade-summary"
 import { GradeFilters } from "@/modules/grades/components/grade-filters"
 import { GradeTrendCard } from "@/modules/grades/components/grade-trend-card"
 import { EmptyState } from "@/shared/components/ui/empty-state"
 import { UserX } from "lucide-react"
+import { getParam, type SearchParams } from "@/shared/lib/search-params"
 
 export const dynamic = "force-dynamic"
 
-type SearchParams = { [key: string]: string | string[] | undefined }
-
-const getParam = (params: SearchParams, key: string) => {
-  const v = params[key]
-  return Array.isArray(v) ? v[0] : v
-}
-
 export default async function StudentGradesPage({
   searchParams,
 }: {
   searchParams: Promise<SearchParams>
 }) {
-  const ctx = await getAuthContext()
+  const ctx = await requirePermission(Permissions.GRADE_RECORD_READ)
   const [sp, summary] = await Promise.all([
     searchParams,
     getStudentGradeSummary(ctx.userId),