feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

cmd/server/wire.go

@@ -4,13 +4,15 @@
 package main
 
 import (
+	"github.com/google/wire"
+
+	"with_you/internal/cache"
 	"with_you/internal/handler"
+	"with_you/internal/middleware"
 	"with_you/internal/repository"
 	"with_you/internal/router"
 	"with_you/internal/service"
 	appwire "with_you/internal/wire"
-
-	"github.com/google/wire"
 )
 
 // InitializeApp 初始化应用程序
@@ -33,6 +35,9 @@ func ProvideRouter(
 	notificationHandler *handler.NotificationHandler,
 	uploadHandler *handler.UploadHandler,
 	jwtService service.JWTService,
+	sessionService service.SessionService,
+	identityProvider middleware.IdentityProvider,
+	cache cache.Cache,
 	pushHandler *handler.PushHandler,
 	systemMessageHandler *handler.SystemMessageHandler,
 	groupHandler *handler.GroupHandler,
@@ -76,6 +81,9 @@ func ProvideRouter(
 		NotificationHandler:      notificationHandler,
 		UploadHandler:            uploadHandler,
 		JWTService:               jwtService,
+		SessionService:           sessionService,
+		IdentityProvider:         identityProvider,
+		Cache:                    cache,
 		PushHandler:              pushHandler,
 		SystemMessageHandler:     systemMessageHandler,
 		GroupHandler:             groupHandler,