fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/core-edu/src/grades/grades.controller.ts

@@ -1,17 +1,26 @@
 import { Body, Controller, Get, Param, Post, Req } from "@nestjs/common";
-import type { Request } from "express";
 import { GradesService, type RecordGradeInput } from "./grades.service.js";
+import {
+  Permissions,
+  RequirePermission,
+} from "../middleware/permission.guard.js";
+import type { AuthenticatedRequest } from "../middleware/auth.middleware.js";
+import { UnauthorizedError } from "../shared/errors/application-error.js";
 
 @Controller("grades")
 export class GradesController {
   constructor(private readonly gradesService: GradesService) {}
 
   @Post()
+  @RequirePermission(Permissions.GRADE_CREATE)
   async record(
     @Body() body: RecordGradeInput,
-    @Req() req: Request,
+    @Req() req: AuthenticatedRequest,
   ): Promise<{ success: true; data: { id: string } }> {
-    const userId = req.headers["x-user-id"] as string;
+    const userId = req.userId;
+    if (!userId) {
+      throw new UnauthorizedError("Missing x-user-id header");
+    }
     const result = await this.gradesService.recordGrade({
       ...body,
       gradedBy: userId,
@@ -20,6 +29,7 @@ export class GradesController {
   }
 
   @Get(":id")
+  @RequirePermission(Permissions.GRADE_READ)
   async findOne(@Param("id") id: string): Promise<{
     success: true;
     data: Awaited<ReturnType<GradesService["getGrade"]>>;
@@ -29,6 +39,7 @@ export class GradesController {
   }
 
   @Get("student/:studentId")
+  @RequirePermission(Permissions.GRADE_READ)
   async listByStudent(@Param("studentId") studentId: string): Promise<{
     success: true;
     data: Awaited<ReturnType<GradesService["listByStudent"]>>;
@@ -38,6 +49,7 @@ export class GradesController {
   }
 
   @Get("exam/:examId")
+  @RequirePermission(Permissions.GRADE_READ)
   async listByExam(@Param("examId") examId: string): Promise<{
     success: true;
     data: Awaited<ReturnType<GradesService["listByExam"]>>;
@@ -47,6 +59,7 @@ export class GradesController {
   }
 
   @Get("homework/:homeworkId")
+  @RequirePermission(Permissions.GRADE_READ)
   async listByHomework(@Param("homeworkId") homeworkId: string): Promise<{
     success: true;
     data: Awaited<ReturnType<GradesService["listByHomework"]>>;