fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

docs/architecture/004_architecture_impact_map.md

@@ -156,7 +156,7 @@ graph TB
 
     subgraph D4["D4 内容资源领域"]
         CONTENT[content 服务]
-        CONTENT_M[textbooks / knowledge-points<br/>questions / grading / search(ES)]
+        CONTENT_M[textbooks / knowledge-points<br/>questions / grading / search]
     end
 
     subgraph D5["D5 沟通通知领域"]
@@ -167,19 +167,19 @@ graph TB
     subgraph D6["D6 智能洞察领域"]
         DATA[data-ana 服务]
         AI[ai 服务]
-        DATA_M[analytics / dashboard / diagnostic(ClickHouse)]
-        AI_M[ai 备课/出题/分析 / search]
+        DATA_M[analytics / dashboard / diagnostic]
+        AI_M[AI 备课 / 出题 / 分析 / 搜索]
     end
 
-    D1 --> D2
-    D1 --> D3
-    D1 --> D4
-    D1 --> D5
-    D2 --> D3
-    D3 --> D4
-    D3 --> D5
-    D4 --> D6
-    D3 --> D6
+    IAM --> ORG
+    IAM --> TEACH
+    IAM --> CONTENT
+    IAM --> MSG
+    ORG --> TEACH
+    TEACH --> CONTENT
+    TEACH --> MSG
+    CONTENT --> DATA
+    TEACH --> DATA
 ```
 
 **双图并存说明**：
@@ -517,24 +517,24 @@ graph LR
         Cmd[Command 命令] --> App[Application Service]
         App --> Domain[Domain 领域模型]
         Domain --> Repo[Repository 写模型]
-        Repo -->[(MySQL 主库)]
+        Repo --> mysql_w[(MySQL 主库)]
         App --> Outbox[(Outbox 表<br/>同事务)]
     end
 
     subgraph Sync["同步链路"]
         Outbox --> Relay[Relay Worker]
-        Relay --> Kafka[(Kafka)]
-        Kafka --> Proj[Projection]
-        Proj -->[(ClickHouse 宽表)]
-        Proj -->[(Redis 缓存)]
-        Proj -->[(ES 索引)]
+        Relay --> kafka_sync[(Kafka)]
+        kafka_sync --> Proj[Projection]
+        Proj --> ch_sync[(ClickHouse 宽表)]
+        Proj --> redis_sync[(Redis 缓存)]
+        Proj --> es_sync[(ES 索引)]
     end
 
     subgraph Read["读路径"]
         Query[Query 查询] --> ReadModel[Read Model]
-        ReadModel -->[(ClickHouse 宽表)]
-        ReadModel -->[(Redis 缓存)]
-        ReadModel -->[(ES 索引)]
+        ReadModel --> ch_read[(ClickHouse 宽表)]
+        ReadModel --> redis_read[(Redis 缓存)]
+        ReadModel --> es_read[(ES 索引)]
     end
 ```
 
@@ -581,7 +581,7 @@ graph LR
         Outbox[(Outbox 表)]
     end
 
-    subgraph MySQL[("MySQL 主库")]
+    subgraph MySQL["MySQL 主库"]
         BizTable[(业务表)]
         OutboxTable[(outbox 表)]
     end
@@ -593,7 +593,7 @@ graph LR
     end
 
     subgraph Bus["事件总线"]
-        Kafka[(Kafka topic)]
+        kafka_bus[(Kafka topic)]
     end
 
     subgraph Consumers["消费者"]
@@ -607,10 +607,10 @@ graph LR
     Repo --> OutboxTable
     OutboxTable --> Poll
     Poll --> Publish
-    Publish --> Kafka
-    Kafka --> Proj
-    Kafka --> OtherSvc
-    Proj -->[(ClickHouse/Redis/ES)]
+    Publish --> kafka_bus
+    kafka_bus --> Proj
+    kafka_bus --> OtherSvc
+    Proj --> read_stores[(ClickHouse / Redis / ES)]
 ```
 
 ### 7.2 事件 Topic 分类