fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/push-gateway/internal/hub/hub.go

@@ -40,6 +40,17 @@ func NewHub() *Hub {
 	}
 }
 
+// ClientCount 返回当前在线连接总数（供 /readyz 探针使用）
+func (h *Hub) ClientCount() int {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	count := 0
+	for _, conns := range h.clients {
+		count += len(conns)
+	}
+	return count
+}
+
 // Register 注册一个用户连接，返回 Connection 供调用方持有
 func (h *Hub) Register(userID string, conn *websocket.Conn) *Connection {
 	c := &Connection{