feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/errors/app_errors.go

@@ -141,6 +141,13 @@ var (
 	ErrVerificationAlreadyHandled = &AppError{Code: "VERIFICATION_ALREADY_HANDLED", Message: "该认证申请已被处理"}
 	ErrVerificationRequired       = &AppError{Code: "VERIFICATION_REQUIRED", Message: "需要完成身份认证"}
 
+	// 认证 / 令牌相关错误（统一由认证管道返回）
+	ErrInvalidToken    = &AppError{Code: "INVALID_TOKEN", Message: "令牌无效"}
+	ErrTokenExpired    = &AppError{Code: "TOKEN_EXPIRED", Message: "令牌已过期"}
+	ErrSessionRevoked  = &AppError{Code: "SESSION_REVOKED", Message: "会话已失效，请重新登录"}
+	ErrAccountInactive = &AppError{Code: "ACCOUNT_INACTIVE", Message: "账号未激活"}
+	ErrWrongTokenType  = &AppError{Code: "WRONG_TOKEN_TYPE", Message: "令牌类型错误"}
+
 	// 初始化相关错误
 	ErrSetupAlreadyCompleted    = &AppError{Code: "SETUP_ALREADY_COMPLETED", Message: "超级管理员已初始化，无法重复设置"}
 	ErrInvalidSetupSecret       = &AppError{Code: "INVALID_SETUP_SECRET", Message: "初始化密钥无效"}