fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/msg/src/notifications/notifications.dto.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+
+export const sendNotificationSchema = z.object({
+  userId: z.string().min(1),
+  type: z.string().min(1).max(50),
+  title: z.string().min(1).max(200),
+  content: z.string().min(1),
+  channel: z.string().max(20).optional(),
+  metadata: z.record(z.unknown()).optional(),
+});
+
+export const sendNotificationBatchSchema = z.array(sendNotificationSchema);
+
+export type SendNotificationDto = z.infer<typeof sendNotificationSchema>;