fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/api-gateway/internal/config/config.go

@@ -1,10 +1,12 @@
 package config
 
 import (
+	"log"
 	"os"
 	"strconv"
 )
 
+// Config 持有 api-gateway 运行时配置
 type Config struct {
 	Port              string
 	JWTSecret         string
@@ -23,10 +25,26 @@ type Config struct {
 	DevMode           bool
 }
 
+// devJWTSecret 是 DevMode 下的默认 JWT 密钥（仅用于本地联调，生产必须配置 JWT_SECRET）
+const devJWTSecret = "p1-dev-secret-change-in-production"
+
+// Load 从环境变量加载配置。
+// 非 DevMode 下若 JWT_SECRET 未配置则 fatal 退出；DevMode 下使用默认密钥并打印 warning。
 func Load() *Config {
+	devMode := getEnvBool("DEV_MODE", false)
+	jwtSecret := getEnv("JWT_SECRET", "")
+	if jwtSecret == "" {
+		if devMode {
+			log.Println("warning: JWT_SECRET not set, using dev default (DEV_MODE=true)")
+			jwtSecret = devJWTSecret
+		} else {
+			log.Fatal("JWT_SECRET must be set in non-dev mode")
+		}
+	}
+
 	return &Config{
 		Port:              getEnv("API_GATEWAY_PORT", "8080"),
-		JWTSecret:         getEnv("JWT_SECRET", "p1-dev-secret-change-in-production"),
+		JWTSecret:         jwtSecret,
 		JWTIssuer:         getEnv("JWT_ISSUER", "next-edu-cloud"),
 		JWTAudience:       getEnv("JWT_AUDIENCE", "next-edu-cloud"),
 		ClassesServiceURL: getEnv("CLASSES_SERVICE_URL", "http://localhost:3001"),
@@ -39,10 +57,11 @@ func Load() *Config {
 		AiServiceURL:      getEnv("AI_SERVICE_URL", "http://localhost:3008"),
 		OTLPEndpoint:      getEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4318"),
 		LogLevel:          getEnv("LOG_LEVEL", "info"),
-		DevMode:           getEnvBool("DEV_MODE", false),
+		DevMode:           devMode,
 	}
 }
 
+// getEnv 读取环境变量，缺失时返回 fallback
 func getEnv(key, fallback string) string {
 	if v := os.Getenv(key); v != "" {
 		return v
@@ -50,15 +69,7 @@ func getEnv(key, fallback string) string {
 	return fallback
 }
 
-func getEnvInt(key string, fallback int) int {
-	if v := os.Getenv(key); v != "" {
-		if i, err := strconv.Atoi(v); err == nil {
-			return i
-		}
-	}
-	return fallback
-}
-
+// getEnvBool 读取环境变量并解析为 bool，缺失或解析失败时返回 fallback
 func getEnvBool(key string, fallback bool) bool {
 	if v := os.Getenv(key); v != "" {
 		if b, err := strconv.ParseBool(v); err == nil {