refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/bootstrap/server_route_test.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 )
 
 func TestNewServerRegistersGinRoutes(t *testing.T) {
@@ -31,16 +31,8 @@ func TestNewServerRegistersGinRoutes(t *testing.T) {
 	}
 
 	expected := []string{
-		http.MethodPost + " /api/auth/login",
 		http.MethodGet + " /api/config",
 		http.MethodGet + " /api/health",
-		http.MethodGet + " /api/auth/oidc_login",
-		http.MethodGet + " /api/auth/oidc_callback",
-		http.MethodPost + " /api/auth/oidc_exchange",
-		http.MethodGet + " /api/auth/profile",
-		http.MethodGet + " /api/dashboard/user/list",
-		http.MethodGet + " /api/dashboard/user/:id",
-		http.MethodPost + " /api/dashboard/user/create",
 		http.MethodPost + " /api/dashboard/conversation/send_message",
 		http.MethodGet + " /api/dashboard/ai-workflow/default-definition",
 		http.MethodGet + " /api/dashboard/ai-workflow/template/list",
@@ -61,6 +53,20 @@ func TestNewServerRegistersGinRoutes(t *testing.T) {
 			t.Fatalf("expected route %s to be registered", route)
 		}
 	}
+
+	removed := []string{
+		http.MethodPost + " /api/auth/login",
+		http.MethodGet + " /api/auth/profile",
+		http.MethodGet + " /api/dashboard/user/list",
+		http.MethodGet + " /api/dashboard/role/list",
+		http.MethodGet + " /api/dashboard/permission/list",
+		http.MethodGet + " /api/dashboard/session/list",
+	}
+	for _, route := range removed {
+		if routes[route] {
+			t.Fatalf("removed local auth route %s is still registered", route)
+		}
+	}
 }
 
 func TestNewServerHealthEndpointIsPublic(t *testing.T) {
@@ -114,10 +120,6 @@ func TestNewServerExposesPublicConfig(t *testing.T) {
 		WxWork: config.WxWorkConfig{
 			Enabled: true,
 		},
-		OIDC: config.OIDCConfig{
-			Enabled:      false,
-			ClientSecret: "must-not-leak",
-		},
 	})
 
 	app, err := NewServer()
@@ -135,9 +137,7 @@ func TestNewServerExposesPublicConfig(t *testing.T) {
 	var body struct {
 		Success bool `json:"success"`
 		Data    struct {
-			Language      string `json:"language"`
-			WxWorkEnabled bool   `json:"wxworkEnabled"`
-			OIDCEnabled   bool   `json:"oidcEnabled"`
+			Language string `json:"language"`
 		} `json:"data"`
 	}
 	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
@@ -149,14 +149,8 @@ func TestNewServerExposesPublicConfig(t *testing.T) {
 	if body.Data.Language != "zh-CN" {
 		t.Fatalf("language=%q want zh-CN", body.Data.Language)
 	}
-	if !body.Data.WxWorkEnabled {
-		t.Fatalf("wxworkEnabled=false want true")
-	}
-	if body.Data.OIDCEnabled {
-		t.Fatalf("oidcEnabled=true want false")
-	}
-	if strings.Contains(rec.Body.String(), "must-not-leak") {
-		t.Fatalf("response leaked sensitive OIDC config: %s", rec.Body.String())
+	if strings.Contains(rec.Body.String(), "wxworkEnabled") || strings.Contains(rec.Body.String(), "oidcEnabled") {
+		t.Fatalf("response still exposes removed login options: %s", rec.Body.String())
 	}
 }