fix: patch P0 security vulnerabilities and critical UX issues across 6 modules

Security: Add admin/layout.tsx auth guard; Add requirePermission() to 12 admin pages

Dashboard: Fix StudentStatsGrid rendering; Fix teacher greeting; Add loading/error boundaries; Fix col-span; Add metadata

Announcements: Fix audience filtering; Add user detail page; Trigger notifications on publish; Pass classes data; Add loading.tsx

Messages: Implement soft delete; Add unread badge with polling; Add notification dropdown polling; Add keyword search; Add quiet hours DND

Management: Add loading/error for 9 admin routes; Fix admin-classes-view to use Select for school/grade

Profile/Settings: Add loading/error; Fix parent role routing; Create ParentSettingsView; Integrate AiProviderSettingsCard; Add Tab URL persistence; Add logout confirm; Add avatar; Fix Progress arbitrary class

Schema: Add senderDeletedAt/receiverDeletedAt to messages; Add quietHours to notificationPreferences; Add uniqueIndex import

Docs: Update architecture docs 004/005

docs/architecture/005_architecture_data.json

@@ -12247,11 +12247,11 @@
       }
     },
     "classes": {
-      "description": "班级/选课/课表",
+      "description": "班级/选课/课表/邀请码（v3 新增邀请码体系，对标 Google Classroom / 钉钉教育）",
       "tables": {
         "classes": {
           "owner": "classes",
-          "description": "班级"
+          "description": "班级（invitationCode 字段保留作为 fallback，v3 迁移至 classInvitationCodes 表）"
         },
         "classSubjectTeachers": {
           "owner": "classes",
@@ -12264,6 +12264,10 @@
         "classSchedule": {
           "owner": "scheduling",
           "description": "课表(注意:三处写入口,见 knownIssues P0-6)"
+        },
+        "classInvitationCodes": {
+          "owner": "classes",
+          "description": "v3 新增：班级邀请码（独立表，支持有效期/次数限制/审计/多码并存，6 位字母数字剔除歧义字符）"
         }
       }
     },
@@ -12601,6 +12605,48 @@
         "v3 P1-4 家长多子女绑定：动态多行 UI，支持一次绑定多个子女",
         "v3 P1-5 跳过机制明确化：parent 不可跳过子女绑定（核心功能）"
       ]
+    },
+    "i18n": {
+      "description": "v3 新增：项目国际化体系（next-intl 4.x，without i18n routing 模式，cookie 驱动）",
+      "tables": {},
+      "exports": {
+        "config": [
+          {
+            "name": "getRequestConfig",
+            "file": "src/i18n/request.ts",
+            "purpose": "next-intl 请求配置：从 cookie 读取 locale，按命名空间加载字典"
+          },
+          {
+            "name": "setLocaleAction",
+            "file": "src/i18n/actions.ts",
+            "purpose": "Server Action：切换语言（写 cookie + revalidatePath）"
+          }
+        ],
+        "shared": [
+          {
+            "name": "LOCALES / Locale / DEFAULT_LOCALE / LOCALE_COOKIE",
+            "file": "src/shared/i18n/locale.ts",
+            "purpose": "locale 常量与工具函数"
+          },
+          {
+            "name": "LocaleSwitcher",
+            "file": "src/shared/components/locale-switcher.tsx",
+            "purpose": "语言切换组件（DropdownMenu + cookie 持久化）"
+          }
+        ],
+        "messages": [
+          "src/shared/i18n/messages/zh-CN/{common,auth,onboarding,classes,errors}.json",
+          "src/shared/i18n/messages/en/{common,auth,onboarding,classes,errors}.json"
+        ]
+      },
+      "routes": {},
+      "securityNotes": [
+        "不使用 URL 路由段，避免破坏现有 (auth)/(dashboard)/(onboarding) 路由组结构",
+        "locale 通过 cookie 持久化，SSR 时由 getRequestConfig 读取",
+        "不使用 Accept-Language 自动协商，避免 SSR 与客户端 hydration 不一致",
+        "字典放在 shared/i18n/messages/，符合三层架构约束（shared 为被依赖方）",
+        "NextIntlClientProvider 在根 layout 注入，服务端/客户端组件均可使用 useTranslations"
+      ]
     }
   },
   "dependencyMatrix": {