fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

pnpm-lock.yaml

@@ -251,6 +251,9 @@ importers:
       '@nestjs/cli':
         specifier: ^10.4.0
         version: 10.4.9
+      '@types/express':
+        specifier: ^4.17.0
+        version: 4.17.25
       '@types/node':
         specifier: ^22.0.0
         version: 22.20.0
@@ -479,6 +482,9 @@ importers:
       '@nestjs/cli':
         specifier: ^10.4.0
         version: 10.4.9
+      '@types/express':
+        specifier: ^4.17.0
+        version: 4.17.25
       '@types/node':
         specifier: ^22.0.0
         version: 22.20.0
@@ -543,6 +549,9 @@ importers:
       eslint:
         specifier: ^9.10.0
         version: 9.39.4(jiti@2.6.1)
+      pino-pretty:
+        specifier: ^11.2.0
+        version: 11.3.0
       typescript:
         specifier: ^5.6.0
         version: 5.9.3