fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/msg/src/shared/errors/global-error.filter.ts

@@ -5,6 +5,7 @@ import {
   HttpException,
   Logger,
 } from "@nestjs/common";
+import type { Request, Response } from "express";
 import { ZodError } from "zod";
 import { ApplicationError } from "./application-error.js";
 
@@ -14,13 +15,12 @@ export class GlobalErrorFilter implements ExceptionFilter {
 
   catch(exception: unknown, host: ArgumentsHost): void {
     const ctx = host.switchToHttp();
-    // NestJS HttpArgumentsHost 的 getResponse/getRequest 返回 express 实例，
-    // 但 msg 服务未引入 @types/express，此处按 core-edu / content 模式不显式标注类型。
-    const response = ctx.getResponse();
-    const request = ctx.getRequest();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
 
+    const traceIdHeader = request.headers["x-request-id"];
     const traceId =
-      (request.headers["x-request-id"] as string | undefined) ?? "unknown";
+      typeof traceIdHeader === "string" ? traceIdHeader : "unknown";
 
     let statusCode = 500;
     let body: Record<string, unknown>;
@@ -30,7 +30,6 @@ export class GlobalErrorFilter implements ExceptionFilter {
       statusCode = exception.statusCode;
       body = exception.toJSON();
     } else if (exception instanceof ZodError) {
-      // FIX #3: 捕获 Zod 解析错误，转换为结构化 ValidationError 响应
       statusCode = 400;
       body = {
         success: false,
@@ -79,7 +78,6 @@ export class GlobalErrorFilter implements ExceptionFilter {
       return res;
     }
     if (res && typeof res === "object" && "message" in res) {
-      // 从 HttpException 响应体收窄类型（NestJS 约定包含 message 字段）
       const msg = (res as { message: unknown }).message;
       return typeof msg === "string" ? msg : exception.message;
     }