fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/api-gateway/main.go

@@ -15,6 +15,7 @@ import (
 	"github.com/edu-cloud/api-gateway/internal/observability"
 	"github.com/edu-cloud/api-gateway/internal/proxy"
 	"github.com/gin-gonic/gin"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
 )
 
@@ -51,6 +52,8 @@ func main() {
 	// 健康检查路由（无需鉴权，在 Auth 之前）
 	r.GET("/healthz", health.Healthz)
 	r.GET("/readyz", health.Readyz)
+	// Prometheus 指标端点
+	r.GET("/metrics", gin.WrapH(promhttp.Handler()))
 
 	// API v1 组：熔断 + 鉴权 + 反向代理
 	api := r.Group("/api/v1")