refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

config/config.example.yaml

@@ -2,7 +2,7 @@ language: zh-CN
 
 server:
   port: 8083
-  # Public address of the independently deployed frontend. Login callbacks redirect here.
+  # Public address of the independently deployed frontend.
   frontendUrl: http://127.0.0.1:3000
   cors:
     # Browser CORS allowlist. In production, replace this with the actual frontend or embedded-site domains, such as https://support.example.com.
@@ -34,25 +34,6 @@ logger:
   format: text
   addSource: false
 
-auth:
-  # Login access token lifetime, in hours. Values <= 0 fall back to 12 hours.
-  # Applies to password login, OIDC login, and WeCom login sessions.
-  tokenTTLHours: 12
-  # Maximum failed password attempts allowed within the lock window.
-  # Values <= 0 disable credential lockout.
-  maxFailedAttempts: 5
-  # Failed-login lock window, in minutes. When maxFailedAttempts is reached within this window, login is temporarily blocked.
-  # Values <= 0 fall back to 15 minutes when lockout is enabled.
-  credentialLockMinute: 15
-
-customerSession:
-  # Signing secret for customer service session tokens. Use a separate, high-entropy random string; do not reuse the channel userTokenSecret.
-  secret: ""
-  # Default lifetime for customer service session tokens, in minutes.
-  ttlMinutes: 120
-  # Automatically refresh the token when its remaining lifetime falls below this value, in minutes.
-  refreshThresholdMinutes: 30
-
 storage:
   # Default file storage provider used for uploads. Supported values: local, oss.
   # Empty value is treated as local by the backend.
@@ -108,25 +89,9 @@ mcp:
       # Extra HTTP headers sent to this MCP server on every request, for example Authorization or tenant headers.
       headers: {}
 
-oidc:
-  # Whether to enable OIDC login. This system acts as the OIDC client.
-  enabled: false
-  # OIDC provider issuer, for example https://idp.example.com/realms/demo.
-  issuer: ""
-  clientId: ""
-  clientSecret: ""
-  # Must exactly match the redirect_uri registered with the OIDC provider.
-  redirectUrl: "http://127.0.0.1:8083/api/auth/oidc_callback"
-  # Signing secret for the OIDC login state. If left empty, clientSecret is used as the fallback.
-  stateSecret: ""
-  scopes:
-    - openid
-    - profile
-    - email
-
 wxWork:
   # Whether to enable WeCom features.
-  # When set to false, the WeCom SDK is not initialized, and login, customer service callbacks, and app notifications are unavailable.
+  # When set to false, the WeCom SDK is not initialized, and customer service callbacks and app notifications are unavailable.
   enabled: false
   # WeCom corporate ID.
   # Example: wwxxxxxxxxxxxxxxxx, from the WeCom admin console.
@@ -134,26 +99,13 @@ wxWork:
   # WeCom app secret.
   # Used by the backend to obtain access tokens and user identities. Keep it confidential.
   corpSecret: ""
-  # AgentID of the WeCom custom app.
-  # Used for web authorization when scope=snsapi_privateinfo.
+  # AgentID of the WeCom custom app, used for app notifications.
   agentId: 
-  # WeCom web authorization callback URL.
-  # Must be a full URL pointing to the backend endpoint:
-  # Example: http://127.0.0.1:8083/api/auth/wxwork_callback
-  # In production, use an official domain that WeCom can access, and make sure the domain is configured in the WeCom admin console.
-  oauthRedirect: ""
-  # Signing secret for the WeCom login state.
-  # Used for tamper protection and replay protection. A separate random string is recommended.
-  # If left empty, the code falls back to corpSecret, but this is not recommended.
-  stateSecret: ""
   # Private key for decrypting WeCom callbacks.
-  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
   rsaPrivateKey: ""
   # WeCom callback token.
-  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
   token: ""
   # WeCom message encryption/decryption EncodingAESKey.
-  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
   encodingAESKey: ""
 
   notify: