fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/api-gateway/internal/middleware/cors.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"log"
 	"net/http"
 	"os"
 	"strconv"
@@ -12,22 +13,26 @@ import (
 // corsMaxAge 预检缓存时长：12 小时
 const corsMaxAge = 12 * 60 * 60
 
+// devCORSOrigins 是未配置 CORS_ORIGINS 时的开发环境默认白名单
+const devCORSOrigins = "http://localhost:3000,http://localhost:3001"
+
 // CORS 返回跨域资源共享中间件。
-// 允许来源从环境变量 CORS_ORIGINS 读取（逗号分隔，默认 *）。
+// 允许来源从环境变量 CORS_ORIGINS 读取（逗号分隔）；
+// 未配置时使用开发环境白名单（localhost:3000/3001）并打印 warning。
 // 允许方法：GET POST PUT DELETE OPTIONS PATCH
 // 允许头：Authorization Content-Type X-Request-Id X-Trace-Id
 // 暴露头：X-Request-Id X-Trace-Id
 func CORS() gin.HandlerFunc {
 	allowed := parseCORSOrigins(os.Getenv("CORS_ORIGINS"))
+	if len(allowed) == 0 {
+		log.Println("warning: CORS_ORIGINS not set, using dev default whitelist")
+		allowed = parseCORSOrigins(devCORSOrigins)
+	}
 
 	return func(c *gin.Context) {
 		origin := c.GetHeader("Origin")
 		allowOrigin := ""
-
-		if len(allowed) == 0 {
-			// 未配置则默认允许所有来源
-			allowOrigin = "*"
-		} else if allowed[origin] {
+		if allowed[origin] {
 			allowOrigin = origin
 		}
 
@@ -39,9 +44,7 @@ func CORS() gin.HandlerFunc {
 			h.Set("Access-Control-Expose-Headers", "X-Request-Id, X-Trace-Id")
 			h.Set("Access-Control-Max-Age", strconv.Itoa(corsMaxAge))
 			// 非通配来源需标注 Vary，便于缓存正确区分
-			if allowOrigin != "*" {
-				h.Add("Vary", "Origin")
-			}
+			h.Add("Vary", "Origin")
 		}
 
 		// 预检请求直接返回 204
@@ -53,7 +56,7 @@ func CORS() gin.HandlerFunc {
 	}
 }
 
-// parseCORSOrigins 解析逗号分隔的来源列表为集合，空字符串返回空 map（表示通配 *）
+// parseCORSOrigins 解析逗号分隔的来源列表为集合，空字符串返回空 map
 func parseCORSOrigins(raw string) map[string]bool {
 	allowed := map[string]bool{}
 	if raw == "" {