feat: M3-M7 全模块落地 + 集成接线

- M3 认证/权限/审计/限流 + 全部 REST 接口
- M4 管理面板（MIUIx + 成绩录入/积分榜下钻/大屏控制）
- M5a 大屏页面（六页 + 明细覆盖层 + 缩放适配）
- M6 WebSocket 实时同步中心
- M7 xlsx 导出 + 赛事包 zip + 备份
- 规则包 YAML 导入导出（差异预览）
- 字体 vendor 子集化（4 套 x2 字重）
- 集成：realtime/export/rules 接入 main+httpapi；backup 子命令
- 修复：中间件包装 ResponseWriter 丢失 Hijacker，导致 WS 握手 501

server/internal/httpapi/repo_import.go

@@ -0,0 +1,52 @@
+package httpapi
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+)
+
+func (s *server) lookupID(ctx context.Context, query string, args ...any) (int64, error) {
+	var id int64
+	if err := s.ev.QueryRowContext(ctx, query, args...).Scan(&id); err != nil {
+		return 0, err
+	}
+	return id, nil
+}
+
+// upsertImportedEntry 按「组别 + 单位 + 运动员」去重；返回 true 表示新建。
+func (s *server) upsertImportedEntry(ctx context.Context, in entryDTO) (bool, error) {
+	var existing int64
+	var err error
+	if in.AthleteID != nil {
+		err = s.ev.QueryRowContext(ctx,
+			`SELECT id FROM entries WHERE category_id = ? AND team_id = ? AND athlete_id = ?`,
+			in.CategoryID, in.TeamID, *in.AthleteID).Scan(&existing)
+	} else {
+		err = s.ev.QueryRowContext(ctx,
+			`SELECT id FROM entries WHERE category_id = ? AND team_id = ? AND athlete_id IS NULL`,
+			in.CategoryID, in.TeamID).Scan(&existing)
+	}
+
+	switch {
+	case errors.Is(err, sql.ErrNoRows):
+		if _, err := s.ev.ExecContext(ctx,
+			`INSERT INTO entries (event_id, category_id, team_id, athlete_id, member_names, bib, seed, status)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+			in.EventID, in.CategoryID, in.TeamID, nullI64(in.AthleteID), marshalNames(in.MemberNames),
+			nullStr(in.Bib), nullStr(in.Seed), orDefault(in.Status, "registered")); err != nil {
+			return false, err
+		}
+		return true, nil
+	case err != nil:
+		return false, err
+	default:
+		if _, err := s.ev.ExecContext(ctx,
+			`UPDATE entries SET member_names = ?, bib = ?, seed = ?, status = ? WHERE id = ?`,
+			marshalNames(in.MemberNames), nullStr(in.Bib), nullStr(in.Seed),
+			orDefault(in.Status, "registered"), existing); err != nil {
+			return false, err
+		}
+		return false, nil
+	}
+}