新增 POST /api/admin/notices、PATCH /api/admin/notices/{id}

保留超级管理员权限边界
支持草稿、发布、置顶、自动摘要
HTML 净化，拦截脚本和危险链接
公告更新与审计日志同事务提交
新增开关 ADMIN_NATIVE_NOTICE_WRITES_ENABLED=false
管理端公告列表和系统自动公告暂时仍由 Node 处理

src/Eis.Web/Program.cs

@@ -48,7 +48,8 @@ var adminMigrationOptions = AdminMigrationOptions.FromEnvironment(
     authenticationOptions.SharesLegacySessions,
     builder.Configuration.GetValue<bool>("AdminMigration:NativeOrganizationWritesEnabled"),
     builder.Configuration.GetValue<bool>("AdminMigration:NativeAccountBatchesEnabled"),
-    builder.Configuration.GetValue<bool>("AdminMigration:NativeConfigurationEnabled"));
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeConfigurationEnabled"),
+    builder.Configuration.GetValue<bool>("AdminMigration:NativeNoticeWritesEnabled"));
 builder.Services.AddEisInfrastructure(
     DatabaseOptions.FromEnvironment(applicationRoot, builder.Environment.IsProduction()),
     DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()),
@@ -106,6 +107,7 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
             nativeOrganizationWritesEnabled = adminMigrationOptions.NativeOrganizationWritesEnabled,
             nativeAccountBatchesEnabled = adminMigrationOptions.NativeAccountBatchesEnabled,
             nativeConfigurationEnabled = adminMigrationOptions.NativeConfigurationEnabled,
+            nativeNoticeWritesEnabled = adminMigrationOptions.NativeNoticeWritesEnabled,
             nativeRoutes = (adminMigrationOptions.NativeReadsEnabled
                     ? new[] { "GET context", "GET dashboard", "GET schools", "GET school-organization", "GET admins", "GET exams" }
                     : [])
@@ -122,6 +124,9 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
                 .Concat(adminMigrationOptions.NativeConfigurationEnabled
                     ? new[] { "GET/POST number-rules", "GET/PUT workflows" }
                     : [])
+                .Concat(adminMigrationOptions.NativeNoticeWritesEnabled
+                    ? new[] { "POST/PATCH notices" }
+                    : [])
                 .ToArray()
         },
         features = MigrationFeatureCatalog.Current(authenticationOptions.NativeEnabled, candidateMigrationOptions.NativeEnabled)