fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/push-gateway/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/edu-cloud/push-gateway/internal/observability"
 	"github.com/edu-cloud/push-gateway/internal/ws"
 	"github.com/gin-gonic/gin"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
 )
 
@@ -26,7 +27,7 @@ func main() {
 	gin.SetMode(gin.ReleaseMode)
 
 	h := hub.NewHub()
-	wsHandler := ws.NewHandler(h, cfg.JWTSecret, cfg.DevMode)
+	wsHandler := ws.NewHandler(h, cfg.JWTSecret, cfg.DevMode, cfg.InternalAPIKey)
 
 	r := gin.New()
 	r.Use(gin.Recovery())
@@ -37,6 +38,18 @@ func main() {
 		c.JSON(200, gin.H{"status": "ok", "service": "push-gateway"})
 	})
 
+	// 就绪探针：检查 WebSocket hub 状态
+	r.GET("/readyz", func(c *gin.Context) {
+		c.JSON(200, gin.H{
+			"status":      "ok",
+			"service":     "push-gateway",
+			"connections": h.ClientCount(),
+		})
+	})
+
+	// Prometheus 指标端点
+	r.GET("/metrics", gin.WrapH(promhttp.Handler()))
+
 	// WebSocket 升级端点
 	r.GET("/ws", wsHandler.HandleWebSocket)