fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/classes/src/shared/lifecycle/lifecycle.service.ts

@@ -1,9 +1,12 @@
-import { Inject, Injectable, Logger, OnApplicationShutdown, OnModuleInit } from '@nestjs/common';
-import { DataSource } from 'typeorm';
-import type { Redis } from 'ioredis';
-import type { Producer } from 'kafkajs';
+import {
+  Injectable,
+  Logger,
+  OnApplicationShutdown,
+  OnModuleInit,
+} from "@nestjs/common";
+import { closeDb } from "../../config/database.js";
 
-const SERVICE_NAME = 'classes';
+const SERVICE_NAME = "classes";
 
 /**
  * 优雅停机服务。
@@ -12,52 +15,31 @@ const SERVICE_NAME = 'classes';
  * 触发（SIGTERM / SIGINT），NestJS 会依次调用 OnApplicationShutdown 钩子。
  * K8s 配置 `terminationGracePeriodSeconds=60` 给予足够时间清理。
  *
- * 关闭顺序：Kafka producer → Redis → DataSource。
- * 先停外部消息生产避免新事件，再关缓存，最后关 DB。
- *
- * 集成说明（不修改 app.module.ts，仅在 README 注释说明）：
- * - 在 `app.module.ts` 的 providers 中加入 `LifecycleService`。
- * - 在 `main.ts` 中 `app.listen` 之前调用 `app.enableShutdownHooks()`。
- *
- * 依赖注入 token 约定（需与各服务 provider 注册一致）：
- * - DataSource：由 `TypeOrmModule.forRoot()` 提供。
- * - 'REDIS_CLIENT'：需在对应模块注册 `{ provide: 'REDIS_CLIENT', useFactory: ... }`。
- * - 'KAFKA_PRODUCER'：需在对应模块注册 `{ provide: 'KAFKA_PRODUCER', useFactory: ... }`。
+ * Classes 服务仅使用 Drizzle ORM（MySQL），无 Kafka / Redis 依赖。
+ * 关闭时仅需关闭数据库连接池。
  */
 @Injectable()
 export class LifecycleService implements OnModuleInit, OnApplicationShutdown {
   private readonly logger = new Logger(LifecycleService.name);
 
-  constructor(
-    private readonly dataSource: DataSource,
-    @Inject('REDIS_CLIENT') private readonly redis: Redis,
-    @Inject('KAFKA_PRODUCER') private readonly kafkaProducer: Producer,
-  ) {}
-
   onModuleInit(): void {
     this.logger.log(`service ${SERVICE_NAME} module initialized`);
   }
 
   async onApplicationShutdown(signal?: string): Promise<void> {
     this.logger.log(
-      `service ${SERVICE_NAME} shutting down (signal=${signal ?? 'unknown'})`,
+      `service ${SERVICE_NAME} shutting down (signal=${signal ?? "unknown"})`,
     );
 
-    await this.safeDisconnect('kafka producer', () => this.kafkaProducer.disconnect());
-    await this.safeDisconnect('redis', () => this.redis.quit());
-    await this.safeDisconnect('datasource', () => this.dataSource.destroy());
+    try {
+      await closeDb();
+      this.logger.log("database connection closed");
+    } catch (error) {
+      this.logger.error(
+        `database close failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    }
 
     this.logger.log(`service ${SERVICE_NAME} shutdown complete`);
   }
-
-  private async safeDisconnect(name: string, fn: () => Promise<unknown>): Promise<void> {
-    try {
-      await fn();
-      this.logger.log(`${name} closed`);
-    } catch (error) {
-      this.logger.error(
-        `${name} close failed: ${error instanceof Error ? error.message : String(error)}`,
-      );
-    }
-  }
 }