fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/iam/src/shared/errors/global-error.filter.ts

@@ -1,7 +1,13 @@
-import { Catch, ExceptionFilter, ArgumentsHost, HttpException, Logger } from '@nestjs/common';
-import { Request, Response } from 'express';
-import { ZodError } from 'zod';
-import { ApplicationError } from './application-error.js';
+import {
+  Catch,
+  ExceptionFilter,
+  ArgumentsHost,
+  HttpException,
+  Logger,
+} from "@nestjs/common";
+import type { Request, Response } from "express";
+import { ZodError } from "zod";
+import { ApplicationError } from "./application-error.js";
 
 @Catch()
 export class GlobalErrorFilter implements ExceptionFilter {
@@ -12,7 +18,9 @@ export class GlobalErrorFilter implements ExceptionFilter {
     const response = ctx.getResponse<Response>();
     const request = ctx.getRequest<Request>();
 
-    const traceId = (request.headers['x-request-id'] as string | undefined) ?? 'unknown';
+    const traceIdHeader = request.headers["x-request-id"];
+    const traceId =
+      typeof traceIdHeader === "string" ? traceIdHeader : "unknown";
 
     let statusCode = 500;
     let body: Record<string, unknown>;
@@ -27,8 +35,8 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'IAM_VALIDATION_ERROR',
-          message: 'Validation failed',
+          code: "IAM_VALIDATION_ERROR",
+          message: "Validation failed",
           details: exception.flatten(),
           traceId,
         },
@@ -40,7 +48,7 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'HTTP_ERROR',
+          code: "HTTP_ERROR",
           message,
           traceId,
         },
@@ -53,8 +61,8 @@ export class GlobalErrorFilter implements ExceptionFilter {
       body = {
         success: false,
         error: {
-          code: 'INTERNAL_ERROR',
-          message: 'An unexpected error occurred',
+          code: "INTERNAL_ERROR",
+          message: "An unexpected error occurred",
           traceId,
         },
       };
@@ -63,14 +71,17 @@ export class GlobalErrorFilter implements ExceptionFilter {
     response.status(statusCode).json(body);
   }
 
-  private extractHttpMessage(res: string | object, exception: HttpException): string {
-    if (typeof res === 'string') {
+  private extractHttpMessage(
+    res: string | object,
+    exception: HttpException,
+  ): string {
+    if (typeof res === "string") {
       return res;
     }
-    if (res && typeof res === 'object' && 'message' in res) {
+    if (res && typeof res === "object" && "message" in res) {
       // 从 HttpException 响应体收窄类型（NestJS 约定包含 message 字段）
       const msg = (res as { message: unknown }).message;
-      return typeof msg === 'string' ? msg : exception.message;
+      return typeof msg === "string" ? msg : exception.message;
     }
     return exception.message;
   }