refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/handlers/dashboard/agent_handler.go

@@ -1,13 +1,14 @@
 package dashboard
 
 import (
-	"agent-desk/internal/builders"
-	"agent-desk/internal/pkg/constants"
-	"agent-desk/internal/pkg/dto/request"
-	"agent-desk/internal/pkg/httpx"
-	"agent-desk/internal/services"
+	"code.tczkiot.com/wlw/ai-agent/internal/builders"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/constants"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/request"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/response"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 
-	"agent-desk/internal/pkg/httpx/params"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx/params"
 
 	"github.com/gin-gonic/gin"
 	"github.com/mlogclub/simple/web"
@@ -44,6 +45,21 @@ func AgentGetList_all(ctx *gin.Context) {
 	httpx.WriteJSON(ctx, builders.BuildAgentProfileList(list))
 }
 
+func AgentGetUser_options(ctx *gin.Context) {
+	if _, err := services.AuthService.RequirePermission(ctx, constants.PermissionAgentView); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	users := services.UserService.Find(ctx.Query("keyword"))
+	results := make([]response.AgentUserOptionResponse, 0, len(users))
+	for _, user := range users {
+		results = append(results, response.AgentUserOptionResponse{
+			ID: user.ID, Username: user.Username, Nickname: user.Nickname, Avatar: user.Avatar,
+		})
+	}
+	httpx.WriteJSON(ctx, results)
+}
+
 func AgentGetBy(ctx *gin.Context) {
 	id, ok := httpx.GetPathInt64(ctx, "id")
 	if !ok {