feat(p2): identity layer with IAM service and Teacher BFF

P2 阶段交付物：
- services/iam: 完整身份认证服务（users/roles/permissions/refresh_tokens 6 表 schema）
  - register/login/refresh/getUserInfo 4 个核心 API
  - bcrypt 密码哈希 + JWT 双 Token（access + refresh）
  - 复用 classes 黄金模板（errors/observability/middleware 三件套）
- services/teacher-bff: 教师聚合 BFF
  - Promise.allSettled 并行聚合 IAM + classes 数据
  - /teacher/dashboard 单一聚合端点
- packages/shared-proto/proto/iam.proto: IamService 契约（Register/Login/RefreshToken/GetUserInfo）
- api-gateway: 新增 IamServiceURL/TeacherBffURL 配置 + /iam/* + /teacher/* 路由

packages/shared-proto/proto/iam.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+package next_edu_cloud.iam.v1;
+
+// IamService 定义身份与访问管理契约
+// P2: REST 实现，P3 起转 gRPC
+service IamService {
+  rpc Register(RegisterRequest) returns (AuthResponse);
+  rpc Login(LoginRequest) returns (AuthResponse);
+  rpc RefreshToken(RefreshTokenRequest) returns (TokenPair);
+  rpc GetUserInfo(GetUserInfoRequest) returns (UserInfo);
+}
+
+message RegisterRequest {
+  string email = 1;
+  string password = 2;
+  string name = 3;
+}
+
+message LoginRequest {
+  string email = 1;
+  string password = 2;
+}
+
+message RefreshTokenRequest {
+  string refresh_token = 1;
+}
+
+message GetUserInfoRequest {
+  string user_id = 1;
+}
+
+message AuthResponse {
+  UserInfo user = 1;
+  TokenPair tokens = 2;
+}
+
+message TokenPair {
+  string access_token = 1;
+  string refresh_token = 2;
+  int32 expires_in = 3;
+}
+
+message UserInfo {
+  string id = 1;
+  string email = 2;
+  string name = 3;
+  repeated string roles = 4;
+  repeated string permissions = 5;
+}