fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/msg/src/middleware/auth.middleware.ts

@@ -0,0 +1,30 @@
+import {
+  Injectable,
+  NestMiddleware,
+  UnauthorizedException,
+} from "@nestjs/common";
+import type { Request, Response, NextFunction } from "express";
+
+export interface AuthenticatedRequest extends Request {
+  userId?: string;
+  userRoles?: string[];
+}
+
+@Injectable()
+export class AuthMiddleware implements NestMiddleware {
+  use(req: AuthenticatedRequest, _res: Response, next: NextFunction): void {
+    const userIdHeader = req.headers["x-user-id"];
+    const userId = typeof userIdHeader === "string" ? userIdHeader : undefined;
+    const rolesHeaderRaw = req.headers["x-user-roles"];
+    const rolesHeader =
+      typeof rolesHeaderRaw === "string" ? rolesHeaderRaw : undefined;
+
+    if (!userId) {
+      throw new UnauthorizedException("Missing x-user-id header");
+    }
+
+    req.userId = userId;
+    req.userRoles = rolesHeader ? rolesHeader.split(",") : [];
+    next();
+  }
+}

services/msg/src/middleware/permission.guard.ts

@@ -0,0 +1,66 @@
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  SetMetadata,
+} from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { PermissionDeniedError } from "../shared/errors/application-error.js";
+import type { AuthenticatedRequest } from "./auth.middleware.js";
+
+export const Permissions = {
+  MSG_NOTIFICATION_SEND: "MSG_NOTIFICATION_SEND" as const,
+  MSG_NOTIFICATION_READ: "MSG_NOTIFICATION_READ" as const,
+  MSG_NOTIFICATION_MANAGE: "MSG_NOTIFICATION_MANAGE" as const,
+} as const;
+
+export type Permission = (typeof Permissions)[keyof typeof Permissions];
+
+export const PERMISSIONS_KEY = "permissions";
+export const RequirePermission = (...permissions: Permission[]) =>
+  SetMetadata(PERMISSIONS_KEY, permissions);
+
+const ROLE_PERMISSIONS: Record<string, Permission[]> = {
+  admin: [
+    Permissions.MSG_NOTIFICATION_SEND,
+    Permissions.MSG_NOTIFICATION_READ,
+    Permissions.MSG_NOTIFICATION_MANAGE,
+  ],
+  teacher: [
+    Permissions.MSG_NOTIFICATION_SEND,
+    Permissions.MSG_NOTIFICATION_READ,
+  ],
+  student: [Permissions.MSG_NOTIFICATION_READ],
+};
+
+@Injectable()
+export class PermissionGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    if (process.env.DEV_MODE === "true") {
+      return true;
+    }
+
+    const requiredPermissions = this.reflector.getAllAndOverride<Permission[]>(
+      PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (!requiredPermissions || requiredPermissions.length === 0) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const roles = request.userRoles ?? [];
+
+    for (const role of roles) {
+      const perms = ROLE_PERMISSIONS[role];
+      if (perms && requiredPermissions.some((p) => perms.includes(p))) {
+        return true;
+      }
+    }
+
+    throw new PermissionDeniedError(requiredPermissions.join(", "));
+  }
+}