You are a Senior Full Stack Engineer and QA Engineer.

Project:
Training Management System (TMS)

Current status:
Sprint 1-6 completed.
Pre-UAT Readiness Review completed.
Before starting Sprint 7, fix all remaining important issues.

Current task:
Implement Sprint 6.5: Pre-Sprint 7 Hardening.

Important constraints:

- Do NOT add new business features.
- Do NOT change folder structure.
- Do NOT migrate ORM unless absolutely necessary.
- Do NOT rename tables or columns.
- Do NOT break existing routes.
- Reuse existing Auth.js.
- Reuse existing Drizzle ORM.
- Keep Thai UI.
- Keep responsive/mobile behavior.
- Minimal-impact changes only.

Priority 1: Notification Pagination Optimization

Problem:
Notification listing currently loads all matching rows, filters in memory, then slices for pagination.

Requirements:

1. Move notification pagination to database query level.
2. Use WHERE, ORDER BY, LIMIT, OFFSET at SQL/Drizzle level.
3. Keep existing search, read/unread filter, and type filter behavior.
4. Keep ownership check:
   - organizationId
   - userId
5. Preserve unread count accuracy.
6. Preserve header notification popover behavior.
7. Do not break Notification Center page.

Files likely involved:

- src/features/notifications/server/notification-data.ts
- src/app/api/notifications/route.ts
- src/features/notifications/api/types.ts
- src/features/notifications/api/service.ts

Priority 2: Announcement Route Loading/Error Coverage

Problem:
Announcement route segment does not have route-level loading.tsx and error.tsx.

Requirements:

1. Add route-level loading and error pages:
   - src/app/dashboard/announcements/loading.tsx
   - src/app/dashboard/announcements/error.tsx
   - src/app/dashboard/announcements/[id]/loading.tsx
   - src/app/dashboard/announcements/[id]/error.tsx
2. Use Thai UI.
3. Follow existing loading/error pattern from other dashboard modules.
4. Keep responsive layout.

Priority 3: RBAC Documentation Update

Problem:
docs/nav-rbac.md is outdated and still references Clerk/client-side authorization.

Requirements:

1. Update docs/nav-rbac.md to reflect current architecture:
   - Auth.js
   - Server-side authorization
   - requireOrganizationAccess()
   - requireHRD()
   - requireEmployeeDashboardAccess()
   - role-based sidebar filtering
   - proxy.ts route protection
2. Remove outdated Clerk references.
3. Document:
   - Employee access
   - HRD access
   - API protection
   - direct URL protection
   - file download protection
4. Keep the document clear and suitable for maintenance.

Priority 4: Browser Smoke Test Checklist

Create a smoke test checklist for:

- Chrome
- Microsoft Edge

Test areas:
Employee:

1. Login
2. View dashboard
3. Create training record
4. Upload certificate
5. Open/download certificate
6. Edit pending training record
7. Delete pending training record
8. View notification
9. View announcement

HRD:

1. Login
2. Open dashboard
3. Review pending training
4. Approve training
5. Reject training
6. Create announcement
7. Open/download announcement attachment
8. Import employee
9. Master review approve/reject
10. View audit logs
11. Export audit log CSV

Priority 5: Output Review File

Create:

docs/sprint-6-5-pre-sprint-7-hardening-review.md

The file must include:

1. Summary
2. Files Changed
3. Issues Fixed
4. Notification Pagination Optimization
5. Announcement Loading/Error Coverage
6. RBAC Documentation Update
7. Browser Smoke Test Checklist
8. Validation Result
9. Remaining Risks
10. Sprint 7 Readiness Score

Validation:

- Run typecheck
- Run lint
- Confirm no new migration is required unless changed
- Confirm existing routes still work

Return:

- Complete code changes with file paths
- Content of docs/sprint-6-5-pre-sprint-7-hardening-review.md
- Any remaining issues