feat: 新增备课模块并修复全模块 P0/P1/P2 缺陷

主要变更:

- 新增 lesson-preparation 模块: 备课编辑器、节点编辑、AI 建议、知识点选择、版本历史、作业发布

- 新增 shared 通用组件: charts/question-bank-filters/schedule-list/ui (chip-nav/filter-bar/page-header/stat-card/stat-item)

- 新增 student/admin 端 loading.tsx 与 error.tsx, 优化加载与错误态体验

- 新增 teacher/lesson-plans 页面 (列表/新建/编辑)

- 新增 drizzle 迁移 0002_tiny_lionheart 及 snapshot

- 新增 textbooks/schema.ts 与 exams/utils/normalize-structure.ts

- 修复 Tiptap v3 SSR hydration 崩溃 (rich-text-block immediatelyRender: false)

- 重构多模块 data-access/actions/组件, 修复权限校验与类型规范

- 同步架构文档 004/005 反映新增模块、导出、依赖关系

- 归档 bugs/* 测试报告与 e2e 测试脚本 (admin/parent/student/teacher web_test)

src/auth.ts

@@ -3,6 +3,7 @@ import NextAuth from "next-auth"
 import Credentials from "next-auth/providers/credentials"
 import { eq } from "drizzle-orm"
 import { resolvePermissions } from "@/shared/lib/permissions"
+import { isRole } from "@/shared/types/permissions"
 import { logLoginEvent } from "@/shared/lib/login-logger"
 import {
   PASSWORD_RULES,
@@ -126,7 +127,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
         token.role = normalizeRole(u.role)
         token.name = u.name ?? undefined
         // Store all roles (not just primary) and resolved permissions
-        const allRoles = u.roles ?? [u.role ?? "student"]
+        const allRoles = (u.roles ?? [u.role ?? "student"]).filter(isRole)
         token.roles = allRoles
         token.permissions = resolvePermissions(allRoles)
       }
@@ -153,7 +154,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
         ])
 
         if (fresh) {
-          const allRoles = roleRows.map((r) => r.name)
+          const allRoles = roleRows.map((r) => r.name).filter(isRole)
           token.role = resolvePrimaryRole(allRoles)
           token.name = fresh.name ?? token.name
           token.roles = allRoles
@@ -167,7 +168,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
       if (session.user) {
         session.user.id = String(token.id ?? "")
         session.user.role = normalizeRole(token.role)
-        session.user.roles = (token.roles ?? []) as string[]
+        session.user.roles = (token.roles ?? []).filter(isRole)
         session.user.permissions = (token.permissions ?? []) as typeof token.permissions
         if (typeof token.name === "string") {
           session.user.name = token.name