refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/middleware/auth_middleware.go

@@ -1,8 +1,8 @@
 package middleware
 
 import (
-	"agent-desk/internal/pkg/i18nx"
-	"agent-desk/internal/services"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/i18nx"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 
 	"github.com/gin-gonic/gin"
 	"github.com/mlogclub/simple/web"

internal/middleware/chat_middleware.go

@@ -1,11 +1,10 @@
 package middleware
 
 import (
-	"agent-desk/internal/pkg/httpx"
-	"agent-desk/internal/services"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
 
 	"github.com/gin-gonic/gin"
-	"github.com/mlogclub/simple/web"
 )
 
 func ExternalUserMiddleware(ctx *gin.Context) {
@@ -15,13 +14,12 @@ func ExternalUserMiddleware(ctx *gin.Context) {
 		ctx.Abort()
 		return
 	}
-	result, err := services.CustomerSessionService.VerifyRequest(ctx, channel)
+	external, err := services.SubjectService.CurrentExternal(ctx.Request.Context())
 	if err != nil {
-		ctx.JSON(200, web.JsonError(err))
+		ctx.JSON(200, httpx.JsonErrorMsg(ctx, "error.auth.expired"))
 		ctx.Abort()
 		return
 	}
-	services.CustomerSessionService.SetRefreshHeaders(ctx, result)
-	httpx.SetExternalUser(ctx, result.ExternalUser)
+	httpx.SetExternalUser(ctx, external)
 	ctx.Next()
 }