feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/database/database_test.go

@@ -109,10 +109,10 @@ func TestSeedPermissions(t *testing.T) {
 		t.Fatal("expected seeded permissions, got 0")
 	}
 
-	// 超级管理员 /* 通配
+	// 超级管理员 admin/** 通配（globMatch 中 ** 跨 '/'）
 	var rule model.CasbinRule
-	if err := db.Where("ptype=? AND v0=? AND v1=?", "p", model.RoleSuperAdmin, "/*").First(&rule).Error; err != nil {
-		t.Errorf("expected superadmin wildcard permission: %v", err)
+	if err := db.Where("ptype=? AND v0=? AND v1=?", "p", model.RoleSuperAdmin, "admin/**").First(&rule).Error; err != nil {
+		t.Errorf("expected superadmin admin/** wildcard permission: %v", err)
 	}
 }