refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/builders/ticket_builder_test.go

@@ -4,8 +4,9 @@ import (
 	"testing"
 	"time"
 
-	"agent-desk/internal/models"
-	"agent-desk/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/models"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 )
 
 func TestBuildLightweightTicket(t *testing.T) {
@@ -32,7 +33,7 @@ func TestBuildLightweightTicket(t *testing.T) {
 		TagsByTicketID: map[int64][]models.Tag{
 			12: {{ID: 8, Name: "登录", Status: enums.StatusOk}},
 		},
-		Users: map[int64]*models.User{
+		Users: map[int64]*services.ExternalUser{
 			5: {ID: 5, Username: "agent", Nickname: "客服"},
 		},
 		Customers: map[int64]*models.Customer{
@@ -101,7 +102,7 @@ func TestBuildTicketProgress(t *testing.T) {
 		CreatedAt: now,
 	}
 	ctx := &TicketDetailBuildContext{
-		Users: map[int64]*models.User{
+		Users: map[int64]*services.ExternalUser{
 			3: {ID: 3, Username: "agent", Nickname: "客服"},
 		},
 	}