refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/ai/rag/vectordb/lancedb.go

@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 
 	"github.com/apache/arrow/go/v17/arrow"
 	"github.com/apache/arrow/go/v17/arrow/array"

internal/ai/rag/vectordb/lancedb_stub.go

@@ -5,7 +5,7 @@ package vectordb
 import (
 	"fmt"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 )
 
 func NewLanceDBProvider(_ *config.LanceDBVectorDBConfig) (Provider, error) {

internal/ai/rag/vectordb/lancedb_test.go

@@ -6,7 +6,7 @@ import (
 	"context"
 	"testing"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 )
 
 func TestLanceDBProviderVectorLifecycle(t *testing.T) {

internal/ai/rag/vectordb/provider.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"fmt"
 
-	"agent-desk/internal/pkg/config"
-	"agent-desk/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
 )
 
 var defaultProvider Provider

internal/ai/rag/vectordb/provider_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 )
 
 func TestInitLanceDBWithoutBuildTagReturnsActionableError(t *testing.T) {

internal/ai/rag/vectordb/qdrant.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/qdrant/go-client/qdrant"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 )
 
 type QdrantProvider struct {