feat: 新增备课模块并修复全模块 P0/P1/P2 缺陷

主要变更:

- 新增 lesson-preparation 模块: 备课编辑器、节点编辑、AI 建议、知识点选择、版本历史、作业发布

- 新增 shared 通用组件: charts/question-bank-filters/schedule-list/ui (chip-nav/filter-bar/page-header/stat-card/stat-item)

- 新增 student/admin 端 loading.tsx 与 error.tsx, 优化加载与错误态体验

- 新增 teacher/lesson-plans 页面 (列表/新建/编辑)

- 新增 drizzle 迁移 0002_tiny_lionheart 及 snapshot

- 新增 textbooks/schema.ts 与 exams/utils/normalize-structure.ts

- 修复 Tiptap v3 SSR hydration 崩溃 (rich-text-block immediatelyRender: false)

- 重构多模块 data-access/actions/组件, 修复权限校验与类型规范

- 同步架构文档 004/005 反映新增模块、导出、依赖关系

- 归档 bugs/* 测试报告与 e2e 测试脚本 (admin/parent/student/teacher web_test)

src/modules/notifications/actions.ts

@@ -11,6 +11,7 @@
  * 班级通知按教师所教班级过滤，确保教师只能给自己班级发通知。
  */
 
+import { z } from "zod"
 import { PermissionDeniedError, requirePermission } from "@/shared/lib/auth-guard"
 import { Permissions } from "@/shared/types/permissions"
 import type { ActionState } from "@/shared/types/action-state"
@@ -20,6 +21,34 @@ import { getClassExists, getStudentIdsByClassId } from "@/modules/classes/data-a
 import { sendNotification, sendBatchNotifications } from "./dispatcher"
 import type { NotificationPayload, ChannelSendResult } from "./types"
 
+/**
+ * Zod 校验：通知负载（sendNotificationAction 入参）
+ * 校验 userId / title / content 必填，type 限定为枚举值
+ */
+const SendNotificationSchema = z.object({
+  userId: z.string().trim().min(1),
+  title: z.string().trim().min(1).max(255),
+  content: z.string().trim().min(1),
+  type: z.enum(["info", "warning", "error", "success"]),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  actionUrl: z.string().trim().max(500).optional(),
+})
+
+/**
+ * Zod 校验：班级通知负载（sendClassNotificationAction 入参）
+ * 与 SendNotificationSchema 类似，但不含 userId（由班级学生列表填充）
+ */
+const SendClassNotificationSchema = z.object({
+  title: z.string().trim().min(1).max(255),
+  content: z.string().trim().min(1),
+  type: z.enum(["info", "warning", "error", "success"]),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  actionUrl: z.string().trim().max(500).optional(),
+})
+
+/** Zod 校验：classId 路径参数 */
+const ClassIdSchema = z.string().trim().min(1)
+
 /**
  * 发送通知给指定用户。
  *
@@ -31,11 +60,16 @@ export async function sendNotificationAction(
   try {
     await requirePermission(Permissions.MESSAGE_SEND)
 
-    if (!payload.userId || !payload.title || !payload.content) {
-      return { success: false, message: "Missing required fields: userId, title, content" }
+    const parsed = SendNotificationSchema.safeParse(payload)
+    if (!parsed.success) {
+      return {
+        success: false,
+        message: "Invalid payload",
+        errors: parsed.error.flatten().fieldErrors,
+      }
     }
 
-    const results = await sendNotification(payload)
+    const results = await sendNotification(parsed.data)
     const allSuccess = results.every((r) => r.success)
     return {
       success: allSuccess,
@@ -64,27 +98,42 @@ export async function sendClassNotificationAction(
   try {
     const ctx = await requirePermission(Permissions.MESSAGE_SEND)
 
-    if (!classId || !payload.title || !payload.content) {
-      return { success: false, message: "Missing required fields: classId, title, content" }
+    const parsedClassId = ClassIdSchema.safeParse(classId)
+    const parsedPayload = SendClassNotificationSchema.safeParse(payload)
+    if (!parsedClassId.success || !parsedPayload.success) {
+      const errors: Record<string, string[]> = {}
+      if (!parsedClassId.success) {
+        errors.classId = parsedClassId.error.flatten().formErrors
+      }
+      if (!parsedPayload.success) {
+        Object.assign(errors, parsedPayload.error.flatten().fieldErrors)
+      }
+      return {
+        success: false,
+        message: "Invalid input",
+        errors,
+      }
     }
 
+    const validClassId = parsedClassId.data
+
     // 权限校验: 教师只能给自己所教班级发通知；管理员可发任意班级
     if (ctx.dataScope.type !== "all") {
       const allowedClassIds =
         ctx.dataScope.type === "class_taught" ? ctx.dataScope.classIds : []
-      if (!allowedClassIds.includes(classId)) {
+      if (!allowedClassIds.includes(validClassId)) {
         return { success: false, message: "You can only send notifications to your own classes" }
       }
     }
 
     // 校验班级是否存在
-    const classExists = await getClassExists(classId)
+    const classExists = await getClassExists(validClassId)
     if (!classExists) {
       return { success: false, message: "Class not found" }
     }
 
     // 查询班级所有学生
-    const studentIds = await getStudentIdsByClassId(classId)
+    const studentIds = await getStudentIdsByClassId(validClassId)
 
     if (studentIds.length === 0) {
       return { success: true, message: "No students in this class", data: [] }
@@ -92,7 +141,7 @@ export async function sendClassNotificationAction(
 
     // 构造每个学生的通知负载
     const payloads: NotificationPayload[] = studentIds.map((studentId) => ({
-      ...payload,
+      ...parsedPayload.data,
       userId: studentId,
     }))