feat: 防御性裁剪测试+500字重字体回退

backend/src/test/java/com/yimeng/okr/service/PerformanceServiceTest.java

@@ -363,6 +363,29 @@ class PerformanceServiceTest {
         assertNotNull(dto.getSelfScore(), "Self can see their self score");
     }
 
+
+    @Test
+    void defensiveBranchClearsAllItemsForNonSuperiorNonHr() {
+        setupPrivacyMocks(1L, 2L, 5L, "SELF_SUBMITTED", "PUBLISHED");
+
+        ScoringDto dto = performanceService.getScoringPage(1L, 2L, 5L);
+
+        assertNull(dto.getSelfItems(), "Defensive: selfItems must be null");
+        assertNull(dto.getSuperiorItems(), "Defensive: superiorItems must be null");
+        assertNull(dto.getFinalItems(), "Defensive: finalItems must be null");
+        assertNull(dto.getFeedback(), "Defensive: feedback must be null");
+        if (dto.getSelfScore() != null) {
+            assertNull(dto.getSelfScore().getCommentsJson(), "Defensive: self commentsJson must be null");
+            assertNull(dto.getSelfScore().getOkrScore(), "Defensive: self okrScore must be null");
+        }
+        if (dto.getSuperiorScore() != null) {
+            assertNull(dto.getSuperiorScore().getOkrScore(), "Defensive: superior okrScore must be null");
+        }
+        if (dto.getFinalScore() != null) {
+            assertNull(dto.getFinalScore().getCommentsJson(), "Defensive: final commentsJson must be null");
+        }
+    }
+
     private void setupPrivacyMocks(Long periodId, Long userId, Long actorId,
                                     String selfStatus, String finalStatus) {
         lenient().when(periodMapper.selectById(periodId)).thenReturn(period());

frontend/src/styles/theme.css

@@ -139,7 +139,8 @@
 }
 @font-face {
   font-family: 'Source Han Sans SC';
-  src: local('Source Han Sans SC Medium'), local('Noto Sans CJK SC Medium');
+  src: local('Source Han Sans SC Medium'), local('Noto Sans CJK SC Medium'),
+       url('https://cdn.jsdelivr.net/npm/@fontsource/noto-sans-sc/files/noto-sans-sc-chinese-simplified-500-normal.woff2') format('woff2');
   font-weight: 500;
   font-style: normal;
   font-display: swap;