feat(yggdrasil): implement standard error responses and UUID format improvements

- Add YggdrasilErrorResponse struct and standard error codes for protocol compliance
- Change UUID storage from varchar(36) to varchar(32) for unsigned format
- Add utility functions: GenerateUUID, FormatUUIDToNoDash, RandomHex
- Support unsigned query parameter in GetProfileByUUID endpoint
- Improve refresh token response with available profiles list
- Fix key pair retrieval to use correct database column (rsa_private_key)
- Update UUID validator to accept both 32-char and 36-char formats
- Add SignStringWithProfileRSA method for profile-specific signing
- Fix profile assignment validation in refresh token flow

internal/errors/errors.go

@@ -60,6 +60,10 @@ var (
 	ErrUUIDRequired        = errors.New("UUID不能为空")
 	ErrCertificateGenerate = errors.New("生成证书失败")
 
+	// Yggdrasil协议标准错误
+	ErrYggForbiddenOperation = errors.New("ForbiddenOperationException")
+	ErrYggIllegalArgument    = errors.New("IllegalArgumentException")
+
 	// 通用错误
 	ErrBadRequest     = errors.New("请求参数错误")
 	ErrInternalServer = errors.New("服务器内部错误")
@@ -138,3 +142,29 @@ func Wrap(err error, message string) error {
 	}
 	return fmt.Errorf("%s: %w", message, err)
 }
+
+// YggdrasilErrorResponse Yggdrasil协议标准错误响应格式
+type YggdrasilErrorResponse struct {
+	Error        string `json:"error"`           // 错误的简要描述（机器可读）
+	ErrorMessage string `json:"errorMessage"`    // 错误的详细信息（人类可读）
+	Cause        string `json:"cause,omitempty"` // 该错误的原因（可选）
+}
+
+// NewYggdrasilErrorResponse 创建Yggdrasil标准错误响应
+func NewYggdrasilErrorResponse(error, errorMessage, cause string) *YggdrasilErrorResponse {
+	return &YggdrasilErrorResponse{
+		Error:        error,
+		ErrorMessage: errorMessage,
+		Cause:        cause,
+	}
+}
+
+// YggdrasilErrorCodes Yggdrasil协议错误码常量
+const (
+	// ForbiddenOperationException 错误消息
+	YggErrInvalidToken       = "Invalid token."
+	YggErrInvalidCredentials = "Invalid credentials. Invalid username or password."
+
+	// IllegalArgumentException 错误消息
+	YggErrProfileAlreadyAssigned = "Access token already has a profile assigned."
+)