refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/services/wxwork_notify_service.go

@@ -1,16 +1,15 @@
 package services
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
-	"agent-desk/internal/pkg/config"
-	"agent-desk/internal/pkg/enums"
-	"agent-desk/internal/repositories"
-	"agent-desk/internal/wxwork"
+	"code.tczkiot.com/wlw/ai-agent/identity"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/wxwork"
 
 	"github.com/mlogclub/simple/common/arrs"
-	"github.com/mlogclub/simple/sqls"
 	wxmessage "github.com/silenceper/wechat/v2/work/message"
 	"github.com/spf13/cast"
 )
@@ -89,16 +88,17 @@ func (s *wxWorkNotifyService) resolveToUsersByUserIDs(userIDs []int64) []string
 	if len(userIDs) == 0 {
 		return nil
 	}
-	cfg := config.Current().WxWork
-	identities := repositories.UserIdentityRepository.Find(sqls.DB(), sqls.NewCnd().
-		Eq("provider", enums.ThirdProviderWxWork).
-		Eq("provider_corp_id", strings.TrimSpace(cfg.CorpID)).
-		Eq("status", enums.StatusOk).
-		In("user_id", userIDs).
-		Asc("id"))
-	toUsers := make([]string, 0, len(identities))
-	for i := range identities {
-		if receiver := strings.TrimSpace(identities[i].ProviderUserID); receiver != "" {
+	subjects, err := SubjectService.Query(context.Background(), identity.Query{
+		Types:       []identity.SubjectType{identity.SubjectAdmin, identity.SubjectAgent},
+		IDs:         userIDs,
+		EnabledOnly: true,
+	})
+	if err != nil {
+		return nil
+	}
+	toUsers := make([]string, 0, len(subjects))
+	for i := range subjects {
+		if receiver := strings.TrimSpace(subjects[i].Bindings["wxwork"]); receiver != "" {
 			toUsers = append(toUsers, receiver)
 		}
 	}