fix(server): Phase 1.2 核心功能修复 — C1/C2/H4/H6

- feat(diary): 新增 list_all_classes 管理端 API (GET /diary/classes/all)
- feat(diary): 新增班级更新 API (PUT /diary/classes/{id}) — 名称/学校名编辑
- feat(diary): 新增班级停用 API (PATCH /diary/classes/{id}/deactivate)
- feat(diary): 新增班级码重置 API (POST /diary/classes/{id}/reset-code)
- fix(db): 补充权限 seed — student 获得 update/delete, teacher 获得 comment.delete
- refactor(diary): 删除 comment_service 中废弃的 contains_sensitive_words 死代码
- test(diary): 77 测试全部通过

crates/erp-server/migration/src/m20260601_000300_diary_role_seed.rs

@@ -33,17 +33,23 @@ impl MigrationTrait for Migration {
             .map_err(|e| DbErr::Custom(e.to_string()))?;
         }
 
-        // student 权限: diary.journal.create, diary.journal.read
-        // teacher 权限: diary.journal.create, diary.journal.read, diary.class.manage, diary.topic.assign, diary.comment.write
+        // student 权限: diary.journal.create, diary.journal.read, diary.journal.update, diary.journal.delete
+        // teacher 权限: diary.journal.create, diary.journal.read, diary.journal.update, diary.journal.delete,
+        //               diary.class.manage, diary.topic.assign, diary.comment.write, diary.comment.delete
         // parent 权限: diary.journal.read, diary.parent.bind
         let role_permissions = [
             ("student", "diary.journal.create"),
             ("student", "diary.journal.read"),
+            ("student", "diary.journal.update"),
+            ("student", "diary.journal.delete"),
             ("teacher", "diary.journal.create"),
             ("teacher", "diary.journal.read"),
+            ("teacher", "diary.journal.update"),
+            ("teacher", "diary.journal.delete"),
             ("teacher", "diary.class.manage"),
             ("teacher", "diary.topic.assign"),
             ("teacher", "diary.comment.write"),
+            ("teacher", "diary.comment.delete"),
             ("parent", "diary.journal.read"),
             ("parent", "diary.parent.bind"),
         ];