fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/data-ana/src/data_ana/config.py

@@ -23,8 +23,8 @@ class Settings(BaseSettings):
     # 可观测性
     otel_endpoint: str = "http://localhost:4318"
     log_level: str = "info"
-    # 开发模式开关（"true"/"false"）
-    dev_mode: str = "false"
+    # 开发模式开关
+    dev_mode: bool = False
     # Kafka brokers（CDC 消费；留空则不启动消费者）
     # 主机访问用 localhost:9092，容器内访问用 kafka:29092
     kafka_brokers: str = ""