fix: patch P0 security vulnerabilities and critical UX issues across 6 modules

Security: Add admin/layout.tsx auth guard; Add requirePermission() to 12 admin pages

Dashboard: Fix StudentStatsGrid rendering; Fix teacher greeting; Add loading/error boundaries; Fix col-span; Add metadata

Announcements: Fix audience filtering; Add user detail page; Trigger notifications on publish; Pass classes data; Add loading.tsx

Messages: Implement soft delete; Add unread badge with polling; Add notification dropdown polling; Add keyword search; Add quiet hours DND

Management: Add loading/error for 9 admin routes; Fix admin-classes-view to use Select for school/grade

Profile/Settings: Add loading/error; Fix parent role routing; Create ParentSettingsView; Integrate AiProviderSettingsCard; Add Tab URL persistence; Add logout confirm; Add avatar; Fix Progress arbitrary class

Schema: Add senderDeletedAt/receiverDeletedAt to messages; Add quietHours to notificationPreferences; Add uniqueIndex import

Docs: Update architecture docs 004/005

src/modules/messaging/components/message-list.tsx

@@ -1,18 +1,20 @@
 "use client"
 
-import { useMemo, useState } from "react"
+import { useEffect, useMemo, useState } from "react"
 import Link from "next/link"
-import { Mail, MailOpen, Plus, Send, Inbox } from "lucide-react"
+import { Mail, MailOpen, Plus, Send, Inbox, Search, Loader2 } from "lucide-react"
 
 import { Badge } from "@/shared/components/ui/badge"
 import { Button } from "@/shared/components/ui/button"
 import { Card, CardContent, CardHeader } from "@/shared/components/ui/card"
 import { EmptyState } from "@/shared/components/ui/empty-state"
+import { Input } from "@/shared/components/ui/input"
 import { Tabs, TabsList, TabsTrigger } from "@/shared/components/ui/tabs"
 import { cn, formatDate } from "@/shared/lib/utils"
 import { usePermission } from "@/shared/hooks/use-permission"
 import { Permissions } from "@/shared/types/permissions"
 
+import { getMessagesAction } from "../actions"
 import type { Message, MessageType } from "../types"
 
 type Tab = "inbox" | "sent"
@@ -27,13 +29,49 @@ export function MessageList({
   initialType?: MessageType
 }) {
   const [tab, setTab] = useState<Tab>(initialType === "sent" ? "sent" : "inbox")
+  const [keyword, setKeyword] = useState("")
+  const [searchResults, setSearchResults] = useState<{ kw: string; tab: Tab; items: Message[] } | null>(null)
   const { hasPermission } = usePermission()
   const canSend = hasPermission(Permissions.MESSAGE_SEND)
 
+  // 防抖搜索：keyword 或 tab 变化时调用 getMessagesAction
+  useEffect(() => {
+    const kw = keyword.trim()
+    if (kw.length === 0) {
+      return
+    }
+
+    let cancelled = false
+    const timer = setTimeout(async () => {
+      if (cancelled) return
+      const res = await getMessagesAction({ type: tab, keyword: kw })
+      if (cancelled) return
+      if (res.success && res.data) {
+        setSearchResults({ kw, tab, items: res.data.items })
+      }
+    }, 400)
+
+    return () => {
+      cancelled = true
+      clearTimeout(timer)
+    }
+  }, [keyword, tab])
+
+  // 当前搜索结果是否匹配最新的 keyword 和 tab
+  const currentResults = searchResults && searchResults.kw === keyword.trim() && searchResults.tab === tab
+    ? searchResults.items
+    : null
+
+  // 搜索中：keyword 非空且尚无匹配结果
+  const searching = keyword.trim().length > 0 && currentResults === null
+
+  // 当 keyword 为空时使用 prop messages，否则使用搜索结果
+  const displayMessages = currentResults ?? messages
+
   const filtered = useMemo(() => {
-    if (tab === "inbox") return messages.filter((m) => m.receiverId === currentUserId)
-    return messages.filter((m) => m.senderId === currentUserId)
-  }, [messages, tab, currentUserId])
+    if (tab === "inbox") return displayMessages.filter((m) => m.receiverId === currentUserId)
+    return displayMessages.filter((m) => m.senderId === currentUserId)
+  }, [displayMessages, tab, currentUserId])
 
   return (
     <div className="space-y-6">
@@ -60,6 +98,21 @@ export function MessageList({
         ) : null}
       </div>
 
+      {/* 搜索框 */}
+      <div className="relative">
+        <Search className="text-muted-foreground absolute left-3 top-1/2 size-4 -translate-y-1/2" />
+        <Input
+          type="search"
+          placeholder="Search messages by subject or content..."
+          value={keyword}
+          onChange={(e) => setKeyword(e.target.value)}
+          className="pl-9"
+        />
+        {searching ? (
+          <Loader2 className="text-muted-foreground absolute right-3 top-1/2 size-4 -translate-y-1/2 animate-spin" />
+        ) : null}
+      </div>
+
       {filtered.length === 0 ? (
         <EmptyState
           title={tab === "inbox" ? "Inbox is empty" : "No sent messages"}