feat(diary): B4+B5+B6 后端服务 + F5/F6/F7 前端模块

后端 (erp-diary):
- B4: CommentService 班级成员验证 + 删除评语 + SSE 通知推送
- B4: NotificationService 评语/主题/成就三类通知事件
- B5: StickerService 贴纸包列表 + 贴纸查询 + 模板管理
- B5: AchievementService 成就列表 + 解锁 + SSE 通知
- B6: MoodStatsService 心情统计 + 连续天数
- B6: ContentSafetyService 敏感词过滤框架
- SSE handler 增加 diary.notification.* 事件处理
- 新增 14 个 API 端点 + diary.comment.delete 权限

前端 (Flutter):
- F5: CalendarBloc + 月视图日历 + 日记列表
- F6: MoodBloc + fl_chart 心情饼图 + 统计卡片 + 连续天数
- F7: 贴纸库分类浏览 + 模板画廊
- 首页改为日记流 + 心情快速选择
- 成就页改为徽章收集展示

验证: cargo check ✓ cargo test 17/17 ✓ flutter analyze 0 error

crates/erp-diary/src/handler/comment_handler.rs

@@ -21,7 +21,7 @@ use crate::state::DiaryState;
         (status = 200, description = "点评成功", body = ApiResponse<CommentResp>),
         (status = 400, description = "验证失败或内容安全检查未通过"),
         (status = 401, description = "未授权"),
-        (status = 403, description = "权限不足"),
+        (status = 403, description = "权限不足或不是本班老师"),
         (status = 404, description = "日记不存在"),
     ),
     security(("bearer_auth" = [])),
@@ -30,6 +30,7 @@ use crate::state::DiaryState;
 /// POST /api/v1/diary/journals/:journal_id/comments
 ///
 /// 老师点评日记。需要 `diary.comment.write` 权限。
+/// 仅本班老师可以点评，私密日记不允许点评。
 pub async fn create_comment<S>(
     State(state): State<DiaryState>,
     Extension(ctx): Extension<TenantContext>,
@@ -88,3 +89,34 @@ where
     let resp = CommentService::list_comments(ctx.tenant_id, journal_id, &state.db).await?;
     Ok(Json(ApiResponse::ok(resp)))
 }
+
+#[utoipa::path(
+    delete,
+    path = "/api/v1/diary/comments/{comment_id}",
+    params(("comment_id" = Uuid, Path, description = "评语ID")),
+    responses(
+        (status = 200, description = "删除成功"),
+        (status = 401, description = "未授权"),
+        (status = 403, description = "权限不足或不是评语作者"),
+        (status = 404, description = "评语不存在"),
+    ),
+    security(("bearer_auth" = [])),
+    tag = "评语管理"
+)]
+/// DELETE /api/v1/diary/comments/:comment_id
+///
+/// 删除评语。仅评语作者可以删除自己的评语。需要 `diary.comment.delete` 权限。
+pub async fn delete_comment<S>(
+    State(state): State<DiaryState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(comment_id): Path<Uuid>,
+) -> Result<Json<ApiResponse<()>>, AppError>
+where
+    DiaryState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "diary.comment.delete")?;
+
+    CommentService::delete_comment(ctx.tenant_id, ctx.user_id, comment_id, &state.db).await?;
+    Ok(Json(ApiResponse::ok(())))
+}