refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/pkg/dto/dto.go

@@ -1,8 +1,12 @@
 package dto
 
-import "agent-desk/internal/pkg/enums"
+import (
+	"code.tczkiot.com/wlw/ai-agent/identity"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+)
 
 type AuthPrincipal struct {
+	SubjectType identity.SubjectType
 	UserID      int64
 	Username    string
 	Nickname    string
@@ -17,17 +21,15 @@ type WxWorkKFChannelConfig struct {
 }
 
 type WebChannelConfig struct {
-	Title           string `json:"title"`
-	Subtitle        string `json:"subtitle"`
-	ThemeColor      string `json:"themeColor"`
-	Position        string `json:"position"`
-	Width           string `json:"width"`
-	UserTokenSecret string `json:"userTokenSecret,omitempty"`
+	Title      string `json:"title"`
+	Subtitle   string `json:"subtitle"`
+	ThemeColor string `json:"themeColor"`
+	Position   string `json:"position"`
+	Width      string `json:"width"`
 }
 
 type WechatMPChannelConfig struct {
-	Title           string `json:"title"`
-	Subtitle        string `json:"subtitle"`
-	ThemeColor      string `json:"themeColor"`
-	UserTokenSecret string `json:"userTokenSecret,omitempty"`
+	Title      string `json:"title"`
+	Subtitle   string `json:"subtitle"`
+	ThemeColor string `json:"themeColor"`
 }