refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/builders/ticket_builder.go

@@ -4,20 +4,20 @@ import (
 	"encoding/json"
 	"strings"
 
-	"agent-desk/internal/models"
-	"agent-desk/internal/pkg/dto/response"
-	"agent-desk/internal/pkg/utils"
-	"agent-desk/internal/services"
+	"code.tczkiot.com/wlw/ai-agent/internal/models"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/response"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/utils"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 )
 
 type TicketBuildContext struct {
 	TagsByTicketID map[int64][]models.Tag
-	Users          map[int64]*models.User
+	Users          map[int64]*services.ExternalUser
 	Customers      map[int64]*models.Customer
 }
 
 type TicketDetailBuildContext struct {
-	Users map[int64]*models.User
+	Users map[int64]*services.ExternalUser
 }
 
 func BuildTicket(item *models.Ticket) *response.TicketResponse {
@@ -180,7 +180,7 @@ func BuildTicketViewList(list []models.TicketView) []response.TicketViewResponse
 	return results
 }
 
-func buildTicketUserDisplayName(user *models.User) string {
+func buildTicketUserDisplayName(user *services.ExternalUser) string {
 	if user == nil {
 		return ""
 	}