已完成管理后台第一批只读功能的 ASP.NET Core 10 迁移：

原生接口：context、dashboard、schools、school-organization、admins、exams
保持超级、校级、班级管理员的数据范围及权限隔离
其余管理写入、审批流和考务编排仍由 Node 转发
新增 ADMIN_NATIVE_READS_ENABLED=true 开关，并强制要求原生认证和共享 Redis

src/Eis.Web/Program.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using Eis.Infrastructure.Authentication;
+using Eis.Infrastructure.Administration;
 using Eis.Infrastructure.Candidate;
 using Eis.Application.Public;
 using Eis.Infrastructure;
@@ -8,6 +9,7 @@ using Eis.Infrastructure.Migration;
 using Eis.Infrastructure.Security;
 using Eis.Web.Configuration;
 using Eis.Web.Authentication;
+using Eis.Web.Administration;
 using Eis.Web.Candidate;
 using Eis.Web.Frontend;
 using Eis.Web.Legacy;
@@ -40,11 +42,16 @@ var candidateMigrationOptions = CandidateMigrationOptions.FromEnvironment(
     builder.Configuration.GetValue<bool>("CandidateMigration:NativeEnabled"),
     authenticationOptions.NativeEnabled,
     authenticationOptions.SharesLegacySessions);
+var adminMigrationOptions = AdminMigrationOptions.FromEnvironment(
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeReadsEnabled"),
+    authenticationOptions.NativeEnabled,
+    authenticationOptions.SharesLegacySessions);
 builder.Services.AddEisInfrastructure(
     DatabaseOptions.FromEnvironment(applicationRoot, builder.Environment.IsProduction()),
     DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()),
     authenticationOptions,
-    candidateMigrationOptions);
+    candidateMigrationOptions,
+    adminMigrationOptions);
 
 var app = builder.Build();
 app.Services.EnsureNativeAuthenticationReady(authenticationOptions);
@@ -90,6 +97,13 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
                 }
                 : []
         },
+        administration = new
+        {
+            nativeReadsEnabled = adminMigrationOptions.NativeReadsEnabled,
+            nativeRoutes = adminMigrationOptions.NativeReadsEnabled
+                ? new[] { "GET context", "GET dashboard", "GET schools", "GET school-organization", "GET admins", "GET exams" }
+                : []
+        },
         features = MigrationFeatureCatalog.Current(authenticationOptions.NativeEnabled, candidateMigrationOptions.NativeEnabled)
     }, statusCode: statusCode);
 });
@@ -97,6 +111,7 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
 app.MapNativePublicEndpoints();
 app.MapNativeAuthenticationEndpoints(authenticationOptions);
 app.MapNativeCandidateEndpoints(candidateMigrationOptions);
+app.MapNativeAdminReadEndpoints(adminMigrationOptions);
 
 string[] methods =
 [