fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/msg/src/config/elasticsearch.ts

@@ -1,35 +1,24 @@
 import { Client } from "@elastic/elasticsearch";
 import { env } from "./env.js";
+import { logger } from "../shared/observability/logger.js";
 
-/**
- * Elasticsearch 客户端。
- *
- * 降级模式：当 ES_URL 未设置或连接失败时，esClient 为 null，
- * 所有 ES 操作通过 safeIndex / safeSearch 自动跳过，服务仍可启动。
- */
 export const esClient: Client | null = env.ES_URL
   ? new Client({ node: env.ES_URL })
   : null;
 
-/**
- * 探活 ES 连接。失败仅记录日志，不抛错（降级模式）。
- */
 export async function checkEsConnection(): Promise<void> {
   if (!esClient) {
-    console.log("Elasticsearch disabled (ES_URL not set)");
+    logger.info("Elasticsearch disabled (ES_URL not set)");
     return;
   }
   try {
     await esClient.ping();
-    console.log("Elasticsearch connected");
+    logger.info("Elasticsearch connected");
   } catch (err) {
-    console.error("Elasticsearch connection failed:", err);
+    logger.error({ err }, "Elasticsearch connection failed");
   }
 }
 
-/**
- * 关闭 ES 客户端连接。
- */
 export async function closeEs(): Promise<void> {
   if (esClient) {
     await esClient.close();
@@ -51,23 +40,20 @@ export interface SearchResult {
   hits: SearchHit[];
 }
 
-/**
- * 安全索引文档。client 为 null 或失败时跳过（降级模式），返回是否成功。
- */
 export async function safeIndex(params: IndexParams): Promise<boolean> {
   if (!esClient) return false;
   try {
     await esClient.index(params);
     return true;
   } catch (err) {
-    console.error("Elasticsearch index failed:", err);
+    logger.error(
+      { err, index: params.index, id: params.id },
+      "Elasticsearch index failed",
+    );
     return false;
   }
 }
 
-/**
- * 安全搜索。client 为 null 或失败时返回空数组（降级模式）。
- */
 export async function safeSearch(
   index: string,
   query: Record<string, unknown>,
@@ -75,13 +61,25 @@ export async function safeSearch(
   if (!esClient) return { hits: [] };
   try {
     const result = await esClient.search({ index, query });
-    const hits = (result.hits.hits as unknown[]).map((raw) => {
-      const hit = raw as { _id: string; _source: Record<string, unknown> };
-      return { _id: hit._id, _source: hit._source };
-    });
+    const hits: SearchHit[] = [];
+    for (const raw of result.hits.hits) {
+      const source = raw._source;
+      if (
+        raw._id &&
+        source &&
+        typeof source === "object" &&
+        !Array.isArray(source)
+      ) {
+        // source 已收窄为 object，但 object 无索引签名，需断言为 Record<string, unknown>
+        hits.push({
+          _id: raw._id,
+          _source: source as Record<string, unknown>,
+        });
+      }
+    }
     return { hits };
   } catch (err) {
-    console.error("Elasticsearch search failed:", err);
+    logger.error({ err, index }, "Elasticsearch search failed");
     return { hits: [] };
   }
 }