refactor: split backend into standalone server project

Remove embedded frontend and workflow editor assets, add standalone API deployment configuration, and retain the current backend service updates.

internal/services/auth_service_test.go

@@ -368,6 +368,54 @@ func TestAuthServiceLogoutRevokesCurrentTokenOnly(t *testing.T) {
 	}
 }
 
+func TestLoadUserPermissionCodesReturnsSortedDistinctCodes(t *testing.T) {
+	db := setupAuthServiceTestDB(t)
+	user := createAuthTestUser(t, db, "admin", "secret")
+	now := time.Now()
+	auditFields := models.AuditFields{CreatedAt: now, UpdatedAt: now}
+
+	permissions := []models.Permission{
+		{Name: "Zulu", Code: "z.read", SortNo: 1, Status: enums.StatusOk, AuditFields: auditFields},
+		{Name: "Alpha", Code: "a.read", SortNo: 2, Status: enums.StatusOk, AuditFields: auditFields},
+	}
+	if err := db.Create(&permissions).Error; err != nil {
+		t.Fatalf("seed permissions: %v", err)
+	}
+
+	roles := []models.Role{
+		{Name: "Role One", Code: "role_one", Status: enums.StatusOk, AuditFields: auditFields},
+		{Name: "Role Two", Code: "role_two", Status: enums.StatusOk, AuditFields: auditFields},
+	}
+	if err := db.Create(&roles).Error; err != nil {
+		t.Fatalf("seed roles: %v", err)
+	}
+
+	userRoles := []models.UserRole{
+		{UserID: user.ID, RoleID: roles[0].ID, AuditFields: auditFields},
+		{UserID: user.ID, RoleID: roles[1].ID, AuditFields: auditFields},
+	}
+	if err := db.Create(&userRoles).Error; err != nil {
+		t.Fatalf("seed user roles: %v", err)
+	}
+
+	rolePermissions := []models.RolePermission{
+		{RoleID: roles[0].ID, PermissionID: permissions[0].ID, AuditFields: auditFields},
+		{RoleID: roles[0].ID, PermissionID: permissions[1].ID, AuditFields: auditFields},
+		{RoleID: roles[1].ID, PermissionID: permissions[0].ID, AuditFields: auditFields},
+	}
+	if err := db.Create(&rolePermissions).Error; err != nil {
+		t.Fatalf("seed role permissions: %v", err)
+	}
+
+	codes, err := newAuthService().loadUserPermissionCodes(db, user.ID)
+	if err != nil {
+		t.Fatalf("load user permission codes: %v", err)
+	}
+	if got, want := strings.Join(codes, ","), "a.read,z.read"; got != want {
+		t.Fatalf("permission codes = %q, want %q", got, want)
+	}
+}
+
 func setupAuthServiceTestDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	db, err := gorm.Open(sqlite.Open("file:"+t.Name()+"?mode=memory&cache=shared"), &gorm.Config{