fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/push-gateway/internal/config/config.go

@@ -1,24 +1,44 @@
 package config
 
-import "os"
+import (
+	"log"
+	"os"
+)
 
 // Config 持有 push-gateway 运行时配置
 type Config struct {
-	Port         string
-	JWTSecret    string
-	DevMode      bool
-	RedisURL     string
-	OTLPEndpoint string
+	Port           string
+	JWTSecret      string
+	DevMode        bool
+	RedisURL       string
+	OTLPEndpoint   string
+	InternalAPIKey string
 }
 
-// Load 从环境变量加载配置并提供默认值
+// devJWTSecret 是 DevMode 下的默认 JWT 密钥（仅用于本地联调，生产必须配置 JWT_SECRET）
+const devJWTSecret = "p1-dev-secret-change-in-production"
+
+// Load 从环境变量加载配置。
+// 非 DevMode 下若 JWT_SECRET 未配置则 fatal 退出；DevMode 下使用默认密钥并打印 warning。
 func Load() *Config {
+	devMode := getEnv("DEV_MODE", "false") == "true"
+	jwtSecret := getEnv("JWT_SECRET", "")
+	if jwtSecret == "" {
+		if devMode {
+			log.Println("warning: JWT_SECRET not set, using dev default (DEV_MODE=true)")
+			jwtSecret = devJWTSecret
+		} else {
+			log.Fatal("JWT_SECRET must be set in non-dev mode")
+		}
+	}
+
 	return &Config{
-		Port:         getEnv("PUSH_GATEWAY_PORT", "8081"),
-		JWTSecret:    getEnv("JWT_SECRET", "p1-dev-secret-change-in-production"),
-		DevMode:      getEnv("DEV_MODE", "false") == "true",
-		RedisURL:     getEnv("REDIS_URL", ""),
-		OTLPEndpoint: getEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4318"),
+		Port:           getEnv("PUSH_GATEWAY_PORT", "8081"),
+		JWTSecret:      jwtSecret,
+		DevMode:        devMode,
+		RedisURL:       getEnv("REDIS_URL", ""),
+		OTLPEndpoint:   getEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4318"),
+		InternalAPIKey: getEnv("INTERNAL_API_KEY", ""),
 	}
 }