refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/services/external_subject_test.go

@@ -0,0 +1,41 @@
+package services_test
+
+import (
+	"context"
+	"slices"
+	"sync"
+
+	"code.tczkiot.com/wlw/ai-agent/identity"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/services"
+)
+
+var testExternalSubjects sync.Map
+
+func registerTestExternalSubject(id int64, username, name string, status enums.Status) {
+	testExternalSubjects.Store(id, identity.Subject{
+		Type:       identity.SubjectAgent,
+		Category:   identity.CategorySystem,
+		ID:         id,
+		Username:   username,
+		Name:       name,
+		Identifier: username,
+		Enabled:    status == enums.StatusOk,
+	})
+	services.SetQuerySubjects(func(_ context.Context, query identity.Query) ([]identity.Subject, error) {
+		results := make([]identity.Subject, 0)
+		testExternalSubjects.Range(func(_, value any) bool {
+			subject := value.(identity.Subject)
+			if len(query.IDs) > 0 && !slices.Contains(query.IDs, subject.ID) {
+				return true
+			}
+			if query.EnabledOnly && !subject.Enabled {
+				return true
+			}
+			results = append(results, subject)
+			return true
+		})
+		return results, nil
+	})
+	services.SetAuthorize(func(_ context.Context, _ string) error { return nil })
+}