fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/classes/src/shared/errors/global-error.filter.ts

@@ -1,7 +1,13 @@
-import { Catch, ExceptionFilter, ArgumentsHost, HttpException, Logger } from '@nestjs/common';
-import { Request, Response } from 'express';
-import { ZodError } from 'zod';
-import { ApplicationError } from './application-error.js';
+import {
+  Catch,
+  ExceptionFilter,
+  ArgumentsHost,
+  HttpException,
+  Logger,
+} from "@nestjs/common";
+import type { Request, Response } from "express";
+import { ZodError } from "zod";
+import { ApplicationError } from "./application-error.js";
 
 @Catch()
 export class GlobalErrorFilter implements ExceptionFilter {
@@ -12,7 +18,9 @@ export class GlobalErrorFilter implements ExceptionFilter {
     const response = ctx.getResponse<Response>();
     const request = ctx.getRequest<Request>();
 
-    const traceId = (request.headers['x-request-id'] as string | undefined) ?? 'unknown';
+    const traceIdHeader = request.headers["x-request-id"];
+    const traceId =
+      typeof traceIdHeader === "string" ? traceIdHeader : "unknown";
 
     let statusCode = 500;
     let body: Record<string, unknown>;
@@ -27,8 +35,8 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'CLASSES_VALIDATION_ERROR',
-          message: 'Validation failed',
+          code: "CLASSES_VALIDATION_ERROR",
+          message: "Validation failed",
           details: exception.flatten(),
           traceId,
         },
@@ -40,7 +48,7 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'HTTP_ERROR',
+          code: "HTTP_ERROR",
           message,
           traceId,
         },
@@ -53,8 +61,8 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'INTERNAL_ERROR',
-          message: 'An unexpected error occurred',
+          code: "INTERNAL_ERROR",
+          message: "An unexpected error occurred",
           traceId,
         },
       };
@@ -63,14 +71,17 @@ export class GlobalErrorFilter implements ExceptionFilter {
     response.status(statusCode).json(body);
   }
 
-  private extractHttpMessage(res: string | object, exception: HttpException): string {
-    if (typeof res === 'string') {
+  private extractHttpMessage(
+    res: string | object,
+    exception: HttpException,
+  ): string {
+    if (typeof res === "string") {
       return res;
     }
-    if (res && typeof res === 'object' && 'message' in res) {
+    if (res && typeof res === "object" && "message" in res) {
       // 从 HttpException 响应体收窄类型（NestJS 约定包含 message 字段）
       const msg = (res as { message: unknown }).message;
-      return typeof msg === 'string' ? msg : exception.message;
+      return typeof msg === "string" ? msg : exception.message;
     }
     return exception.message;
   }

services/classes/src/shared/lifecycle/lifecycle.service.ts

@@ -1,9 +1,12 @@
-import { Inject, Injectable, Logger, OnApplicationShutdown, OnModuleInit } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import type { Redis } from 'ioredis';
-import type { Producer } from 'kafkajs';
+import {
+  Injectable,
+  Logger,
+  OnApplicationShutdown,
+  OnModuleInit,
+} from "@nestjs/common";
+import { closeDb } from "../../config/database.js";
 
-const SERVICE_NAME = 'classes';
+const SERVICE_NAME = "classes";
 
 /**
  * 优雅停机服务。
@@ -12,52 +15,31 @@ const SERVICE_NAME = 'classes';
  * 触发（SIGTERM / SIGINT），NestJS 会依次调用 OnApplicationShutdown 钩子。
  * K8s 配置 `terminationGracePeriodSeconds=60` 给予足够时间清理。
  *
- * 关闭顺序：Kafka producer → Redis → DataSource。
- * 先停外部消息生产避免新事件，再关缓存，最后关 DB。
- *
- * 集成说明（不修改 app.module.ts，仅在 README 注释说明）：
- * - 在 `app.module.ts` 的 providers 中加入 `LifecycleService`。
- * - 在 `main.ts` 中 `app.listen` 之前调用 `app.enableShutdownHooks()`。
- *
- * 依赖注入 token 约定（需与各服务 provider 注册一致）：
- * - DataSource：由 `TypeOrmModule.forRoot()` 提供。
- * - 'REDIS_CLIENT'：需在对应模块注册 `{ provide: 'REDIS_CLIENT', useFactory: ... }`。
- * - 'KAFKA_PRODUCER'：需在对应模块注册 `{ provide: 'KAFKA_PRODUCER', useFactory: ... }`。
+ * Classes 服务仅使用 Drizzle ORM（MySQL），无 Kafka / Redis 依赖。
+ * 关闭时仅需关闭数据库连接池。
  */
 @Injectable()
 export class LifecycleService implements OnModuleInit, OnApplicationShutdown {
   private readonly logger = new Logger(LifecycleService.name);
 
-  constructor(
-    private readonly dataSource: DataSource,
-    @Inject('REDIS_CLIENT') private readonly redis: Redis,
-    @Inject('KAFKA_PRODUCER') private readonly kafkaProducer: Producer,
-  ) {}
-
   onModuleInit(): void {
     this.logger.log(`service ${SERVICE_NAME} module initialized`);
   }
 
   async onApplicationShutdown(signal?: string): Promise<void> {
     this.logger.log(
-      `service ${SERVICE_NAME} shutting down (signal=${signal ?? 'unknown'})`,
+      `service ${SERVICE_NAME} shutting down (signal=${signal ?? "unknown"})`,
     );
 
-    await this.safeDisconnect('kafka producer', () => this.kafkaProducer.disconnect());
-    await this.safeDisconnect('redis', () => this.redis.quit());
-    await this.safeDisconnect('datasource', () => this.dataSource.destroy());
+    try {
+      await closeDb();
+      this.logger.log("database connection closed");
+    } catch (error) {
+      this.logger.error(
+        `database close failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
 
     this.logger.log(`service ${SERVICE_NAME} shutdown complete`);
   }
-
-  private async safeDisconnect(name: string, fn: () => Promise<unknown>): Promise<void> {
-    try {
-      await fn();
-      this.logger.log(`${name} closed`);
-    } catch (error) {
-      this.logger.error(
-        `${name} close failed: ${error instanceof Error ? error.message : String(error)}`,
-      );
-    }
-  }
 }