feat: 新增备课模块并修复全模块 P0/P1/P2 缺陷

主要变更:

- 新增 lesson-preparation 模块: 备课编辑器、节点编辑、AI 建议、知识点选择、版本历史、作业发布

- 新增 shared 通用组件: charts/question-bank-filters/schedule-list/ui (chip-nav/filter-bar/page-header/stat-card/stat-item)

- 新增 student/admin 端 loading.tsx 与 error.tsx, 优化加载与错误态体验

- 新增 teacher/lesson-plans 页面 (列表/新建/编辑)

- 新增 drizzle 迁移 0002_tiny_lionheart 及 snapshot

- 新增 textbooks/schema.ts 与 exams/utils/normalize-structure.ts

- 修复 Tiptap v3 SSR hydration 崩溃 (rich-text-block immediatelyRender: false)

- 重构多模块 data-access/actions/组件, 修复权限校验与类型规范

- 同步架构文档 004/005 反映新增模块、导出、依赖关系

- 归档 bugs/* 测试报告与 e2e 测试脚本 (admin/parent/student/teacher web_test)

src/shared/lib/auth-guard.ts

@@ -1,7 +1,8 @@
-import type { Permission, DataScope, AuthContext } from "@/shared/types/permissions"
+import type { Permission, DataScope, AuthContext, Role } from "@/shared/types/permissions"
 import { db } from "@/shared/db"
 import {
   classes,
+  classEnrollments,
   classSubjectTeachers,
   grades,
   parentStudentRelations,
@@ -11,7 +12,9 @@ import { getSession } from "@/shared/lib/session"
 
 export class PermissionDeniedError extends Error {
   constructor(permission: string) {
-    super(`Permission denied: ${permission}`)
+    super(
+      `权限不足：需要 ${permission} 权限。请联系管理员授权或切换账号后重试。`
+    )
     this.name = "PermissionDeniedError"
   }
 }
@@ -26,7 +29,7 @@ export async function getAuthContext(): Promise<AuthContext> {
   if (!userId) throw new PermissionDeniedError("auth_required")
 
   // Prefer session data (already resolved in JWT callback)
-  const roleNames = (session.user.roles ?? []) as string[]
+  const roleNames = (session.user.roles ?? []) as Role[]
   const permissions = (session.user.permissions ?? []) as Permission[]
 
   // Resolve data scope from DB (not cached in JWT since it can change)
@@ -61,7 +64,7 @@ export async function checkPermission(
  * Resolve the data scope for a user based on their roles.
  * Queries the DB for resource ownership information.
  */
-async function resolveDataScope(userId: string, roleNames: string[]): Promise<DataScope> {
+async function resolveDataScope(userId: string, roleNames: Role[]): Promise<DataScope> {
   // Admin sees everything
   if (roleNames.includes("admin")) {
     return { type: "all" }
@@ -111,8 +114,17 @@ async function resolveDataScope(userId: string, roleNames: string[]): Promise<Da
   }
 
   // Student: can see data from their enrolled classes
+  // Pre-resolve classIds here to avoid N+1 queries in data-access layer
   if (roleNames.includes("student")) {
-    return { type: "class_members" }
+    const enrolledClasses = await db
+      .select({ classId: classEnrollments.classId })
+      .from(classEnrollments)
+      .where(eq(classEnrollments.studentId, userId))
+
+    return {
+      type: "class_members",
+      classIds: enrolledClasses.map((c) => c.classId),
+    }
   }
 
   // Parent: can see their children's data