fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/content/src/app.module.ts

@@ -1,9 +1,12 @@
 import { Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
 import { TextbooksModule } from "./textbooks/textbooks.module.js";
 import { ChaptersModule } from "./chapters/chapters.module.js";
 import { KnowledgePointsModule } from "./knowledge-points/knowledge-points.module.js";
 import { QuestionsModule } from "./questions/questions.module.js";
 import { HealthModule } from "./shared/health/health.module.js";
+import { PermissionGuard } from "./middleware/permission.guard.js";
+import { LifecycleService } from "./shared/lifecycle/lifecycle.service.js";
 
 @Module({
   imports: [
@@ -13,5 +16,9 @@ import { HealthModule } from "./shared/health/health.module.js";
     QuestionsModule,
     HealthModule,
   ],
+  providers: [
+    { provide: APP_GUARD, useClass: PermissionGuard },
+    LifecycleService,
+  ],
 })
 export class AppModule {}