fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/content/src/chapters/chapters.controller.ts

@@ -13,12 +13,17 @@ import {
   type UpdateChapterInput,
 } from "./chapters.service.js";
 import type { Chapter } from "./chapters.schema.js";
+import {
+  Permissions,
+  RequirePermission,
+} from "../middleware/permission.guard.js";
 
 @Controller("chapters")
 export class ChaptersController {
   constructor(private readonly service: ChaptersService) {}
 
   @Post()
+  @RequirePermission(Permissions.CONTENT_CHAPTER_CREATE)
   async create(
     @Body() body: CreateChapterInput,
   ): Promise<{ success: true; data: { id: string } }> {
@@ -27,6 +32,7 @@ export class ChaptersController {
   }
 
   @Get("textbook/:textbookId")
+  @RequirePermission(Permissions.CONTENT_CHAPTER_READ)
   async listByTextbook(
     @Param("textbookId") textbookId: string,
   ): Promise<{ success: true; data: Chapter[] }> {
@@ -35,6 +41,7 @@ export class ChaptersController {
   }
 
   @Get(":id")
+  @RequirePermission(Permissions.CONTENT_CHAPTER_READ)
   async getById(
     @Param("id") id: string,
   ): Promise<{ success: true; data: Chapter }> {
@@ -43,6 +50,7 @@ export class ChaptersController {
   }
 
   @Put(":id")
+  @RequirePermission(Permissions.CONTENT_CHAPTER_UPDATE)
   async update(
     @Param("id") id: string,
     @Body() body: UpdateChapterInput,
@@ -52,6 +60,7 @@ export class ChaptersController {
   }
 
   @Delete(":id")
+  @RequirePermission(Permissions.CONTENT_CHAPTER_DELETE)
   async remove(
     @Param("id") id: string,
   ): Promise<{ success: true; data: { success: true } }> {