refactor: 将客服后端重构为宿主可嵌入模块

- 注入数据库、运行时配置、统一响应、文件存储和平台 AI 能力，补充业务读写工具与客户快捷操作契约。

- 移除模块内重复的组织、客户、工单、标签、技能、旧工作流、MCP 和迁移实现，将身份权限与业务主体交由宿主管理。

- 使用 libSQL 重构向量存储，并完善图片消息、访客身份、排队调度、企业微信和支持聊天页面。

- 统一 HTTP、DTO 与 WebSocket 的 snake_case 协议，补齐模块初始化、业务动作和公共载荷等回归测试。

internal/services/auth_service_test.go

@@ -66,3 +66,68 @@ func TestExternalAuthRejectsHostDeniedOperation(t *testing.T) {
 		t.Fatal("RequirePermission() error = nil, want forbidden")
 	}
 }
+
+func TestExternalAuthRejectsAgentAsDashboardOperator(t *testing.T) {
+	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		if !query.Current {
+			return nil, nil
+		}
+		return []identity.Subject{{
+			Type: identity.SubjectAgent, Category: identity.CategorySystem, ID: 10, Enabled: true,
+		}}, nil
+	})
+	SetAuthorize(func(_ context.Context, _ string) error { return nil })
+
+	ctx, _ := gin.CreateTestContext(httptest.NewRecorder())
+	ctx.Request = httptest.NewRequest("GET", "/api/dashboard/conversation/list", nil)
+	if _, err := AuthService.Authenticate(ctx); err == nil {
+		t.Fatal("Authenticate() error = nil, want agent dashboard access rejected")
+	}
+}
+
+func TestAgentIdentityActsAsExternalCustomer(t *testing.T) {
+	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		if !query.Current {
+			return nil, nil
+		}
+		return []identity.Subject{{
+			Type: identity.SubjectAgent, Category: identity.CategoryUser, ID: 12,
+			Name: "Agent Customer", Enabled: true,
+		}}, nil
+	})
+
+	external, err := SubjectService.CurrentExternal(context.Background())
+	if err != nil {
+		t.Fatalf("CurrentExternal() error = %v", err)
+	}
+	if external.ExternalID != "agent:12" || external.ExternalName != "Agent Customer" {
+		t.Fatalf("external = %#v", external)
+	}
+}
+
+func TestAnonymousGuestIdentityFallback(t *testing.T) {
+	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		if query.Current {
+			return nil, nil
+		}
+		return nil, nil
+	})
+
+	external, err := SubjectService.ResolveExternal(context.Background(), "guest_123", "Web Visitor")
+	if err != nil {
+		t.Fatalf("ResolveExternal() error = %v", err)
+	}
+	if external.ExternalSource != "guest" || external.ExternalID != "guest_123" || external.ExternalName != "Web Visitor" {
+		t.Fatalf("external = %#v", external)
+	}
+}
+
+func TestAnonymousGuestIdentityRequiresOpaqueID(t *testing.T) {
+	SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		return nil, nil
+	})
+
+	if _, err := SubjectService.ResolveExternal(context.Background(), "", "Web Visitor"); err == nil {
+		t.Fatal("ResolveExternal() error = nil, want missing guest id rejected")
+	}
+}