已完成管理后台第一批只读功能的 ASP.NET Core 10 迁移：

原生接口：context、dashboard、schools、school-organization、admins、exams
保持超级、校级、班级管理员的数据范围及权限隔离
其余管理写入、审批流和考务编排仍由 Node 转发
新增 ADMIN_NATIVE_READS_ENABLED=true 开关，并强制要求原生认证和共享 Redis

src/Eis.Web/Administration/NativeAdminReadEndpoints.cs

@@ -0,0 +1,39 @@
+using Eis.Application.Administration;
+using Eis.Infrastructure.Administration;
+
+namespace Eis.Web.Administration;
+
+public static class NativeAdminReadEndpoints
+{
+    public static IEndpointRouteBuilder MapNativeAdminReadEndpoints(
+        this IEndpointRouteBuilder endpoints,
+        AdminMigrationOptions options)
+    {
+        if (!options.NativeReadsEnabled) return endpoints;
+
+        endpoints.MapGet("/api/admin/context", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetContextAsync(Token(context), cancellationToken)));
+        endpoints.MapGet("/api/admin/dashboard", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetDashboardAsync(Token(context), cancellationToken)));
+        endpoints.MapGet("/api/admin/schools", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetSchoolsAsync(Token(context), cancellationToken)));
+        endpoints.MapGet("/api/admin/school-organization", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetSchoolOrganizationAsync(Token(context), cancellationToken)));
+        endpoints.MapGet("/api/admin/admins", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetAdminsAsync(Token(context), cancellationToken)));
+        endpoints.MapGet("/api/admin/exams", (HttpContext context, IAdminReadService service, CancellationToken cancellationToken) =>
+            Execute(context, service.GetExamsAsync(Token(context), cancellationToken)));
+        return endpoints;
+    }
+
+    private static async Task<IResult> Execute(HttpContext context, Task<AdminEndpointResult> operation)
+    {
+        var result = await operation;
+        context.Response.Headers.CacheControl = "no-store";
+        context.Response.Headers["X-EIS-Implementation"] = "aspnet-core";
+        return Results.Json(result.Body, statusCode: result.StatusCode);
+    }
+
+    private static string Token(HttpContext context) =>
+        context.Request.Cookies.TryGetValue("hz_session", out var token) ? token : string.Empty;
+}

src/Eis.Web/Program.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using Eis.Infrastructure.Authentication;
+using Eis.Infrastructure.Administration;
 using Eis.Infrastructure.Candidate;
 using Eis.Application.Public;
 using Eis.Infrastructure;
@@ -8,6 +9,7 @@ using Eis.Infrastructure.Migration;
 using Eis.Infrastructure.Security;
 using Eis.Web.Configuration;
 using Eis.Web.Authentication;
+using Eis.Web.Administration;
 using Eis.Web.Candidate;
 using Eis.Web.Frontend;
 using Eis.Web.Legacy;
@@ -40,11 +42,16 @@ var candidateMigrationOptions = CandidateMigrationOptions.FromEnvironment(
     builder.Configuration.GetValue<bool>("CandidateMigration:NativeEnabled"),
     authenticationOptions.NativeEnabled,
     authenticationOptions.SharesLegacySessions);
+var adminMigrationOptions = AdminMigrationOptions.FromEnvironment(
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeReadsEnabled"),
+    authenticationOptions.NativeEnabled,
+    authenticationOptions.SharesLegacySessions);
 builder.Services.AddEisInfrastructure(
     DatabaseOptions.FromEnvironment(applicationRoot, builder.Environment.IsProduction()),
     DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()),
     authenticationOptions,
-    candidateMigrationOptions);
+    candidateMigrationOptions,
+    adminMigrationOptions);
 
 var app = builder.Build();
 app.Services.EnsureNativeAuthenticationReady(authenticationOptions);
@@ -90,6 +97,13 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
                 }
                 : []
         },
+        administration = new
+        {
+            nativeReadsEnabled = adminMigrationOptions.NativeReadsEnabled,
+            nativeRoutes = adminMigrationOptions.NativeReadsEnabled
+                ? new[] { "GET context", "GET dashboard", "GET schools", "GET school-organization", "GET admins", "GET exams" }
+                : []
+        },
         features = MigrationFeatureCatalog.Current(authenticationOptions.NativeEnabled, candidateMigrationOptions.NativeEnabled)
     }, statusCode: statusCode);
 });
@@ -97,6 +111,7 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
 app.MapNativePublicEndpoints();
 app.MapNativeAuthenticationEndpoints(authenticationOptions);
 app.MapNativeCandidateEndpoints(candidateMigrationOptions);
+app.MapNativeAdminReadEndpoints(adminMigrationOptions);
 
 string[] methods =
 [

src/Eis.Web/appsettings.json

@@ -9,6 +9,9 @@
   "CandidateMigration": {
     "NativeEnabled": false
   },
+  "AdminMigration": {
+    "NativeReadsEnabled": false
+  },
   "Logging": {
     "LogLevel": {
       "Default": "Information",