fix: Phase 1.3 完善修复 — 管理端对接 + HMS清理 + 编辑器加载

- feat(web): ClassList.tsx 对接 update/deactivate/reset-code API
  - 编辑班级: PUT /diary/classes/:id
  - 停用班级: PATCH /diary/classes/:id/deactivate (Popconfirm 确认)
  - 重置班级码: POST /diary/classes/:id/reset-code (Popconfirm 确认)
  - 数据源改用 listAll() 获取所有班级
- fix(web): JournalList.tsx 班级筛选改用 classApi.listAll()
- fix(app): EditorPage 加载已有日记数据 (journalId 非空时)
  - 从 Isar 恢复笔画/元素/标签/心情/标题
  - _EditorView 改为 StatefulWidget + initState 加载
- chore(web): HMS 遗留代码清理
  - 删除 api/copilot.ts, healthFixtures.ts, healthHandlers.ts
  - AuditLogViewer 资源类型替换为日记模块类型
  - auth.test.ts / renderWithProviders 权限码 health.* → diary.*
- docs: 确认 M6 NotificationService 为误报 (已在 3 处调用)

apps/web/src/stores/auth.test.ts

@@ -85,7 +85,7 @@ function createFakeUser(overrides: Partial<UserInfo> = {}): UserInfo {
 
 function createFakeLoginResponse(overrides: Partial<LoginResponse> = {}): LoginResponse {
   return {
-    access_token: createFakeToken(['health.patient.list', 'health.alerts.manage']),
+    access_token: createFakeToken(['diary.journal.read', 'diary.class.manage']),
     refresh_token: 'refresh-token-xxx',
     expires_in: 3600,
     user: createFakeUser(),
@@ -157,7 +157,7 @@ describe('useAuthStore', () => {
       expect(state.user).toEqual(fakeUser);
       expect(state.isAuthenticated).toBe(true);
       expect(state.loading).toBe(false);
-      expect(state.permissions).toEqual(['health.patient.list', 'health.alerts.manage']);
+      expect(state.permissions).toEqual(['diary.journal.read', 'diary.class.manage']);
 
       // API 被正确调用
       expect(mockApiLogin).toHaveBeenCalledWith({ username: 'testuser', password: 'password123' });
@@ -254,7 +254,7 @@ describe('useAuthStore', () => {
       useAuthStore.setState({
         user: createFakeUser(),
         isAuthenticated: true,
-        permissions: ['health.patient.list'],
+        permissions: ['diary.journal.read'],
       });
       localStorageStore['access_token'] = 'some-token';
 
@@ -283,7 +283,7 @@ describe('useAuthStore', () => {
   // =========================================================================
   describe('权限提取', () => {
     it('登录后 permissions 应从 JWT token 中正确解析', async () => {
-      const permissions = ['health.patient.list', 'health.alerts.manage', 'health.report.review'];
+      const permissions = ['diary.journal.read', 'diary.class.manage', 'diary.topic.assign'];
       const token = createFakeToken(permissions);
       const fakeResponse = createFakeLoginResponse({ access_token: token });
       mockApiLogin.mockResolvedValue(fakeResponse);
@@ -336,7 +336,7 @@ describe('useAuthStore', () => {
   describe('loadFromStorage', () => {
     it('localStorage 有有效 token 和 user 时应恢复认证状态', () => {
       const fakeUser = createFakeUser();
-      const permissions = ['health.patient.list'];
+      const permissions = ['diary.journal.read'];
       const token = createFakeToken(permissions);
 
       localStorageStore['access_token'] = token;
@@ -362,7 +362,7 @@ describe('useAuthStore', () => {
     });
 
     it('localStorage 无 user 时应保持未认证', () => {
-      localStorageStore['access_token'] = createFakeToken(['health.patient.list']);
+      localStorageStore['access_token'] = createFakeToken(['diary.journal.read']);
       // 不设置 user
 
       useAuthStore.getState().loadFromStorage();