refactor(auth): delegate access control to be-system

Remove Agent Desk users, roles, login sessions, tokens, and local permission persistence. Expose the backend as an embeddable ai-agent module with host-provided subject lookup and operation authorization callbacks, and complete the frontend/backend repository split.

internal/wxwork/wxwork.go

@@ -1,14 +1,12 @@
 package wxwork
 
 import (
-	"agent-desk/internal/pkg/config"
+	"code.tczkiot.com/wlw/ai-agent/internal/pkg/config"
 	"strings"
 
 	"github.com/silenceper/wechat/v2/cache"
 	"github.com/silenceper/wechat/v2/work"
-	"github.com/silenceper/wechat/v2/work/addresslist"
 	wxconfig "github.com/silenceper/wechat/v2/work/config"
-	"github.com/silenceper/wechat/v2/work/oauth"
 )
 
 var (
@@ -16,22 +14,6 @@ var (
 	wxCfg config.WxWorkConfig
 )
 
-type LoginUser struct {
-	CorpID         string                       `json:"corpId"`
-	UserID         string                       `json:"userId"`
-	OpenID         string                       `json:"openId,omitempty"`
-	ExternalUserID string                       `json:"externalUserId,omitempty"`
-	UserTicket     string                       `json:"userTicket,omitempty"`
-	Name           string                       `json:"name,omitempty"`
-	Avatar         string                       `json:"avatar,omitempty"`
-	Mobile         string                       `json:"mobile,omitempty"`
-	Email          string                       `json:"email,omitempty"`
-	BizMail        string                       `json:"bizMail,omitempty"`
-	UserInfo       *oauth.GetUserInfoResponse   `json:"userInfo,omitempty"`
-	UserDetail     *oauth.GetUserDetailResponse `json:"userDetail,omitempty"`
-	UserProfile    *addresslist.UserGetResponse `json:"userProfile,omitempty"`
-}
-
 func Init() {
 	w = nil
 	wxCfg = config.WxWorkConfig{}
@@ -58,13 +40,6 @@ func Enabled() bool {
 	return w != nil && wxCfg.Enabled
 }
 
-func StateSecret() string {
-	if strings.TrimSpace(wxCfg.StateSecret) != "" {
-		return strings.TrimSpace(wxCfg.StateSecret)
-	}
-	return strings.TrimSpace(wxCfg.CorpSecret)
-}
-
 func GetWorkCli() *work.Work {
 	return w
 }