refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

agentdesk.go

@@ -0,0 +1,36 @@
+package agentdesk
+
+import (
+	"errors"
+	"net/http"
+
+	"code.tczkiot.com/wlw/ai-agent/identity"
+	"code.tczkiot.com/wlw/ai-agent/internal/bootstrap"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
+)
+
+type Options struct {
+	ConfigPath    string
+	QuerySubjects identity.QuerySubjectsFunc
+	Authorize     identity.AuthorizeFunc
+}
+
+// New initializes the customer-service business module. Authentication and
+// authorization must already have been completed by the host system.
+func New(options Options) (http.Handler, error) {
+	if options.QuerySubjects == nil {
+		return nil, errors.New("agent-desk: QuerySubjects is required")
+	}
+	if options.Authorize == nil {
+		return nil, errors.New("agent-desk: Authorize is required")
+	}
+	if options.ConfigPath == "" {
+		options.ConfigPath = "config/config.yaml"
+	}
+	services.SetQuerySubjects(options.QuerySubjects)
+	services.SetAuthorize(options.Authorize)
+	if err := bootstrap.Init(options.ConfigPath); err != nil {
+		return nil, err
+	}
+	return bootstrap.NewServer()
+}