refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/ai/runtime/workflow/executor_test.go

@@ -3,15 +3,17 @@ package workflow
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
-	"agent-desk/internal/ai/workflow/dsl"
-	workflowregistry "agent-desk/internal/ai/workflow/registry"
-	"agent-desk/internal/models"
-	"agent-desk/internal/pkg/enums"
-	"agent-desk/internal/services"
+	"code.tczkiot.com/wlw/ai-agent/identity"
+	"code.tczkiot.com/wlw/ai-agent/internal/ai/workflow/dsl"
+	workflowregistry "code.tczkiot.com/wlw/ai-agent/internal/ai/workflow/registry"
+	"code.tczkiot.com/wlw/ai-agent/internal/models"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 
 	"github.com/glebarez/sqlite"
 	"github.com/mlogclub/simple/sqls"
@@ -913,7 +915,6 @@ func setupWorkflowExecutorHandoffDB(t *testing.T) *gorm.DB {
 		}
 	})
 	if err := db.AutoMigrate(
-		&models.User{},
 		&models.Customer{},
 		&models.CustomerIdentity{},
 		&models.AIAgent{},
@@ -975,14 +976,20 @@ func createWorkflowExecutorHandoffActiveSchedule(t *testing.T, db *gorm.DB, team
 
 func createWorkflowExecutorHandoffAgentProfile(t *testing.T, db *gorm.DB, userID int64, teamID int64) {
 	t.Helper()
-	if err := db.Create(&models.User{
-		ID:       userID,
-		Username: "agent",
-		Nickname: "客服",
-		Status:   enums.StatusOk,
-	}).Error; err != nil {
-		t.Fatalf("create user error = %v", err)
-	}
+	services.SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		if len(query.IDs) > 0 && !slices.Contains(query.IDs, userID) {
+			return nil, nil
+		}
+		return []identity.Subject{{
+			Type:       identity.SubjectAgent,
+			Category:   identity.CategorySystem,
+			ID:         userID,
+			Username:   "agent",
+			Name:       "客服",
+			Identifier: "agent",
+			Enabled:    true,
+		}}, nil
+	})
 	if err := db.Create(&models.AgentProfile{
 		UserID:             userID,
 		TeamID:             teamID,