fix: patch P0 security vulnerabilities and critical UX issues across 6 modules

Security: Add admin/layout.tsx auth guard; Add requirePermission() to 12 admin pages

Dashboard: Fix StudentStatsGrid rendering; Fix teacher greeting; Add loading/error boundaries; Fix col-span; Add metadata

Announcements: Fix audience filtering; Add user detail page; Trigger notifications on publish; Pass classes data; Add loading.tsx

Messages: Implement soft delete; Add unread badge with polling; Add notification dropdown polling; Add keyword search; Add quiet hours DND

Management: Add loading/error for 9 admin routes; Fix admin-classes-view to use Select for school/grade

Profile/Settings: Add loading/error; Fix parent role routing; Create ParentSettingsView; Integrate AiProviderSettingsCard; Add Tab URL persistence; Add logout confirm; Add avatar; Fix Progress arbitrary class

Schema: Add senderDeletedAt/receiverDeletedAt to messages; Add quietHours to notificationPreferences; Add uniqueIndex import

Docs: Update architecture docs 004/005

src/modules/messaging/components/message-list.tsx

@@ -1,18 +1,20 @@
 "use client"
 
-import { useMemo, useState } from "react"
+import { useEffect, useMemo, useState } from "react"
 import Link from "next/link"
-import { Mail, MailOpen, Plus, Send, Inbox } from "lucide-react"
+import { Mail, MailOpen, Plus, Send, Inbox, Search, Loader2 } from "lucide-react"
 
 import { Badge } from "@/shared/components/ui/badge"
 import { Button } from "@/shared/components/ui/button"
 import { Card, CardContent, CardHeader } from "@/shared/components/ui/card"
 import { EmptyState } from "@/shared/components/ui/empty-state"
+import { Input } from "@/shared/components/ui/input"
 import { Tabs, TabsList, TabsTrigger } from "@/shared/components/ui/tabs"
 import { cn, formatDate } from "@/shared/lib/utils"
 import { usePermission } from "@/shared/hooks/use-permission"
 import { Permissions } from "@/shared/types/permissions"
 
+import { getMessagesAction } from "../actions"
 import type { Message, MessageType } from "../types"
 
 type Tab = "inbox" | "sent"
@@ -27,13 +29,49 @@ export function MessageList({
   initialType?: MessageType
 }) {
   const [tab, setTab] = useState<Tab>(initialType === "sent" ? "sent" : "inbox")
+  const [keyword, setKeyword] = useState("")
+  const [searchResults, setSearchResults] = useState<{ kw: string; tab: Tab; items: Message[] } | null>(null)
   const { hasPermission } = usePermission()
   const canSend = hasPermission(Permissions.MESSAGE_SEND)
 
+  // 防抖搜索：keyword 或 tab 变化时调用 getMessagesAction
+  useEffect(() => {
+    const kw = keyword.trim()
+    if (kw.length === 0) {
+      return
+    }
+
+    let cancelled = false
+    const timer = setTimeout(async () => {
+      if (cancelled) return
+      const res = await getMessagesAction({ type: tab, keyword: kw })
+      if (cancelled) return
+      if (res.success && res.data) {
+        setSearchResults({ kw, tab, items: res.data.items })
+      }
+    }, 400)
+
+    return () => {
+      cancelled = true
+      clearTimeout(timer)
+    }
+  }, [keyword, tab])
+
+  // 当前搜索结果是否匹配最新的 keyword 和 tab
+  const currentResults = searchResults && searchResults.kw === keyword.trim() && searchResults.tab === tab
+    ? searchResults.items
+    : null
+
+  // 搜索中：keyword 非空且尚无匹配结果
+  const searching = keyword.trim().length > 0 && currentResults === null
+
+  // 当 keyword 为空时使用 prop messages，否则使用搜索结果
+  const displayMessages = currentResults ?? messages
+
   const filtered = useMemo(() => {
-    if (tab === "inbox") return messages.filter((m) => m.receiverId === currentUserId)
-    return messages.filter((m) => m.senderId === currentUserId)
-  }, [messages, tab, currentUserId])
+    if (tab === "inbox") return displayMessages.filter((m) => m.receiverId === currentUserId)
+    return displayMessages.filter((m) => m.senderId === currentUserId)
+  }, [displayMessages, tab, currentUserId])
 
   return (
     <div className="space-y-6">
@@ -60,6 +98,21 @@ export function MessageList({
         ) : null}
       </div>
 
+      {/* 搜索框 */}
+      <div className="relative">
+        <Search className="text-muted-foreground absolute left-3 top-1/2 size-4 -translate-y-1/2" />
+        <Input
+          type="search"
+          placeholder="Search messages by subject or content..."
+          value={keyword}
+          onChange={(e) => setKeyword(e.target.value)}
+          className="pl-9"
+        />
+        {searching ? (
+          <Loader2 className="text-muted-foreground absolute right-3 top-1/2 size-4 -translate-y-1/2 animate-spin" />
+        ) : null}
+      </div>
+
       {filtered.length === 0 ? (
         <EmptyState
           title={tab === "inbox" ? "Inbox is empty" : "No sent messages"}

src/modules/messaging/components/notification-dropdown.tsx

@@ -20,6 +20,7 @@ import { cn, formatDate } from "@/shared/lib/utils"
 
 import {
   getNotificationsAction,
+  getUnreadNotificationCountAction,
   markAllNotificationsAsReadAction,
   markNotificationAsReadAction,
 } from "../actions"
@@ -40,16 +41,35 @@ export function NotificationDropdown() {
 
   useEffect(() => {
     let active = true
-    void (async () => {
+
+    const fetchNotifications = async () => {
       const res = await getNotificationsAction({ pageSize: 10 })
       if (!active) return
       if (res.success && res.data) {
         setNotifications(res.data.items)
-        setUnreadCount(res.data.items.filter((n) => !n.isRead).length)
       }
-    })()
+    }
+
+    const fetchUnreadCount = async () => {
+      const res = await getUnreadNotificationCountAction()
+      if (!active) return
+      if (res.success && typeof res.data === "number") {
+        setUnreadCount(res.data)
+      }
+    }
+
+    void fetchNotifications()
+    void fetchUnreadCount()
+
+    // 每 30 秒轮询刷新通知和未读计数
+    const timer = setInterval(() => {
+      void fetchNotifications()
+      void fetchUnreadCount()
+    }, 30_000)
+
     return () => {
       active = false
+      clearInterval(timer)
     }
   }, [])
 

src/modules/messaging/components/unread-message-badge.tsx

@@ -0,0 +1,51 @@
+"use client"
+
+import { useEffect, useState } from "react"
+
+import { Badge } from "@/shared/components/ui/badge"
+
+import { getUnreadMessageCountAction } from "../actions"
+
+/**
+ * 未读消息计数徽章
+ *
+ * 在侧边栏 Messages 导航项旁显示未读私信数。
+ * 每 60 秒轮询一次以保持计数更新。
+ */
+export function UnreadMessageBadge() {
+  const [count, setCount] = useState(0)
+
+  useEffect(() => {
+    let active = true
+
+    const fetchCount = async () => {
+      const res = await getUnreadMessageCountAction()
+      if (!active) return
+      if (res.success && typeof res.data === "number") {
+        setCount(res.data)
+      }
+    }
+
+    void fetchCount()
+
+    const timer = setInterval(() => {
+      void fetchCount()
+    }, 60_000)
+
+    return () => {
+      active = false
+      clearInterval(timer)
+    }
+  }, [])
+
+  if (count <= 0) return null
+
+  return (
+    <Badge
+      variant="destructive"
+      className="ml-auto flex h-5 min-w-5 items-center justify-center px-1.5 text-[10px]"
+    >
+      {count > 99 ? "99+" : count}
+    </Badge>
+  )
+}