feat(p2): identity layer with IAM service and Teacher BFF

P2 阶段交付物：
- services/iam: 完整身份认证服务（users/roles/permissions/refresh_tokens 6 表 schema）
  - register/login/refresh/getUserInfo 4 个核心 API
  - bcrypt 密码哈希 + JWT 双 Token（access + refresh）
  - 复用 classes 黄金模板（errors/observability/middleware 三件套）
- services/teacher-bff: 教师聚合 BFF
  - Promise.allSettled 并行聚合 IAM + classes 数据
  - /teacher/dashboard 单一聚合端点
- packages/shared-proto/proto/iam.proto: IamService 契约（Register/Login/RefreshToken/GetUserInfo）
- api-gateway: 新增 IamServiceURL/TeacherBffURL 配置 + /iam/* + /teacher/* 路由

services/api-gateway/internal/config/config.go

@@ -11,6 +11,8 @@ type Config struct {
 	JWTIssuer         string
 	JWTAudience       string
 	ClassesServiceURL string
+	IamServiceURL     string
+	TeacherBffURL     string
 	OTLPEndpoint      string
 	LogLevel          string
 }
@@ -22,6 +24,8 @@ func Load() *Config {
 		JWTIssuer:         getEnv("JWT_ISSUER", "next-edu-cloud"),
 		JWTAudience:       getEnv("JWT_AUDIENCE", "next-edu-cloud"),
 		ClassesServiceURL: getEnv("CLASSES_SERVICE_URL", "http://localhost:3001"),
+		IamServiceURL:     getEnv("IAM_SERVICE_URL", "http://localhost:3002"),
+		TeacherBffURL:     getEnv("TEACHER_BFF_URL", "http://localhost:3003"),
 		OTLPEndpoint:      getEnv("OTEL_EXPORTER_OTLP_ENDPOINT", "http://localhost:4318"),
 		LogLevel:          getEnv("LOG_LEVEL", "info"),
 	}

services/api-gateway/internal/routing/routing.go

@@ -1,4 +1,4 @@
-package routing
+package routing
 
 import (
 	"github.com/edu-cloud/api-gateway/internal/config"
@@ -29,6 +29,20 @@ func Setup(cfg *config.Config) *gin.Engine {
 			panic("failed to create classes proxy: " + err.Error())
 		}
 		api.Any("/classes/*path", proxy.ProxyHandler(classesProxy))
+
+		// IAM 服务路由（身份与访问管理）
+		iamProxy, err := proxy.NewProxy(cfg.IamServiceURL)
+		if err != nil {
+			panic("failed to create iam proxy: " + err.Error())
+		}
+		api.Any("/iam/*path", proxy.ProxyHandler(iamProxy))
+
+		// Teacher BFF 路由（教师聚合层）
+		bffProxy, err := proxy.NewProxy(cfg.TeacherBffURL)
+		if err != nil {
+			panic("failed to create teacher-bff proxy: " + err.Error())
+		}
+		api.Any("/teacher/*path", proxy.ProxyHandler(bffProxy))
 	}
 
 	return r