refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

identity/identity.go

@@ -0,0 +1,46 @@
+package identity
+
+import "context"
+
+type SubjectType string
+
+const (
+	SubjectAdmin    SubjectType = "admin"
+	SubjectAgent    SubjectType = "agent"
+	SubjectCard     SubjectType = "card"
+	SubjectDevice   SubjectType = "device"
+	SubjectMallUser SubjectType = "mall_user"
+)
+
+type SubjectCategory string
+
+const (
+	CategorySystem SubjectCategory = "system"
+	CategoryUser   SubjectCategory = "user"
+)
+
+type Subject struct {
+	Type       SubjectType       `json:"type"`
+	Category   SubjectCategory   `json:"category"`
+	ID         int64             `json:"id"`
+	Username   string            `json:"username"`
+	Name       string            `json:"name"`
+	Avatar     string            `json:"avatar"`
+	Identifier string            `json:"identifier"`
+	Enabled    bool              `json:"enabled"`
+	Bindings   map[string]string `json:"bindings,omitempty"`
+}
+
+type Query struct {
+	Types       []SubjectType
+	IDs         []int64
+	Keyword     string
+	Current     bool
+	EnabledOnly bool
+}
+
+type QuerySubjectsFunc func(ctx context.Context, query Query) ([]Subject, error)
+
+// AuthorizeFunc delegates a customer-service operation to the host system.
+// Returning a non-nil error denies the operation.
+type AuthorizeFunc func(ctx context.Context, operation string) error