refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/services/ticket_service.go

@@ -5,18 +5,18 @@ import (
 	"strings"
 	"time"
 
-	"agent-desk/internal/events"
-	"agent-desk/internal/models"
-	"agent-desk/internal/pkg/dto"
-	"agent-desk/internal/pkg/dto/request"
-	"agent-desk/internal/pkg/enums"
-	"agent-desk/internal/pkg/errorsx"
-	"agent-desk/internal/pkg/eventbus"
-	"agent-desk/internal/pkg/i18nx"
-	"agent-desk/internal/pkg/utils"
-	"agent-desk/internal/repositories"
+	"code.tczkiot.com/wlw/ai-agent/internal/events"
+	"code.tczkiot.com/wlw/ai-agent/internal/models"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/dto/request"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/enums"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/errorsx"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/eventbus"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/i18nx"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/utils"
+	"code.tczkiot.com/wlw/ai-agent/internal/repositories"
 
-	"agent-desk/internal/pkg/httpx/params"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/httpx/params"
 
 	"github.com/mlogclub/simple/sqls"
 	"gorm.io/gorm"
@@ -33,7 +33,7 @@ type TicketDetailAggregate struct {
 	Tags       []models.Tag
 	Customer   *models.Customer
 	Progresses []models.TicketProgress
-	Users      map[int64]*models.User
+	Users      map[int64]*ExternalUser
 }
 
 type TicketSummaryAggregate struct {
@@ -50,7 +50,7 @@ type TicketListAggregate struct {
 	List           []models.Ticket
 	Paging         *sqls.Paging
 	TagsByTicketID map[int64][]models.Tag
-	Users          map[int64]*models.User
+	Users          map[int64]*ExternalUser
 	Customers      map[int64]*models.Customer
 }
 
@@ -66,7 +66,7 @@ func normalizeTicketStaleHours(staleHours int) int {
 	}
 }
 
-func buildTicketAssignmentProgressContent(fromUser *models.User, toUser *models.User, reason string) string {
+func buildTicketAssignmentProgressContent(fromUser *ExternalUser, toUser *ExternalUser, reason string) string {
 	fromName := ticketAssignmentUserDisplayName(fromUser)
 	if fromName == "" {
 		fromName = "未分配"
@@ -82,7 +82,7 @@ func buildTicketAssignmentProgressContent(fromUser *models.User, toUser *models.
 	return content
 }
 
-func ticketAssignmentUserDisplayName(user *models.User) string {
+func ticketAssignmentUserDisplayName(user *ExternalUser) string {
 	if user == nil {
 		return ""
 	}
@@ -445,7 +445,7 @@ func (s *ticketService) GetDetail(id int64) (*TicketDetailAggregate, error) {
 		Ticket:     ticket,
 		Tags:       s.GetTags(id),
 		Progresses: repositories.TicketProgressRepository.Find(sqls.DB(), sqls.NewCnd().Eq("ticket_id", id).Asc("id")),
-		Users:      make(map[int64]*models.User),
+		Users:      make(map[int64]*ExternalUser),
 	}
 	if ticket.CustomerID > 0 {
 		aggregate.Customer = CustomerService.Get(ticket.CustomerID)
@@ -467,7 +467,7 @@ func (s *ticketService) GetDetail(id int64) (*TicketDetailAggregate, error) {
 		addUserID(aggregate.Progresses[i].AuthorID)
 	}
 	if len(userIDs) > 0 {
-		users := repositories.UserRepository.FindByIds(sqls.DB(), userIDs)
+		users := UserService.FindByIds(userIDs)
 		for i := range users {
 			item := users[i]
 			aggregate.Users[item.ID] = &item
@@ -503,13 +503,13 @@ func (s *ticketService) assignTicketTx(tx *gorm.DB, req request.AssignTicketRequ
 	if err := s.validateRequiredAssignee(req.ToUserID); err != nil {
 		return nil, err
 	}
-	toUser := repositories.UserRepository.Get(tx, req.ToUserID)
+	toUser := UserService.Get(req.ToUserID)
 	if toUser == nil || toUser.Status != enums.StatusOk {
 		return nil, errorsx.InvalidParamI18n("error.e0334")
 	}
-	var fromUser *models.User
+	var fromUser *ExternalUser
 	if ticket.CurrentAssigneeID > 0 {
-		fromUser = repositories.UserRepository.Get(tx, ticket.CurrentAssigneeID)
+		fromUser = UserService.Get(ticket.CurrentAssigneeID)
 	}
 	now := time.Now()
 	if err := repositories.TicketRepository.Updates(tx, ticket.ID, map[string]any{
@@ -542,7 +542,7 @@ func (s *ticketService) buildTicketListAggregate(db *gorm.DB, list []models.Tick
 		List:           list,
 		Paging:         paging,
 		TagsByTicketID: make(map[int64][]models.Tag),
-		Users:          make(map[int64]*models.User),
+		Users:          make(map[int64]*ExternalUser),
 		Customers:      make(map[int64]*models.Customer),
 	}
 	if len(list) == 0 {
@@ -575,7 +575,7 @@ func (s *ticketService) buildTicketListAggregate(db *gorm.DB, list []models.Tick
 	}
 	s.enrichTicketTags(db, aggregate, ticketIDs)
 	if len(userIDs) > 0 {
-		users := repositories.UserRepository.FindByIds(db, userIDs)
+		users := UserService.FindByIds(userIDs)
 		for i := range users {
 			item := users[i]
 			aggregate.Users[item.ID] = &item