feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/middleware/auth.go

@@ -1,76 +1,6 @@
-package middleware
-
-import (
-	"strings"
-
-	"github.com/gin-gonic/gin"
-
-	"with_you/internal/pkg/response"
-	"with_you/internal/service"
-)
-
-// Auth 认证中间件
-func Auth(jwtService service.JWTService) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-
-		if authHeader == "" {
-			response.Unauthorized(c, "authorization header is required")
-			c.Abort()
-			return
-		}
-
-		// 提取Token
-		prefix, token, found := strings.Cut(authHeader, " ")
-		if !found || prefix != "Bearer" {
-			response.Unauthorized(c, "invalid authorization header format")
-			c.Abort()
-			return
-		}
-
-		// 验证Token
-		claims, err := jwtService.ParseToken(token)
-		if err != nil {
-			response.Unauthorized(c, "invalid token")
-			c.Abort()
-			return
-		}
-
-		// 将用户信息存入上下文
-		c.Set("user_id", claims.UserID)
-		c.Set("username", claims.Username)
-
-		c.Next()
-	}
-}
-
-// OptionalAuth 可选认证中间件
-func OptionalAuth(jwtService service.JWTService) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-		if authHeader == "" {
-			c.Next()
-			return
-		}
-
-		// 提取Token
-		prefix, token, found := strings.Cut(authHeader, " ")
-		if !found || prefix != "Bearer" {
-			c.Next()
-			return
-		}
-
-		// 验证Token
-		claims, err := jwtService.ParseToken(token)
-		if err != nil {
-			c.Next()
-			return
-		}
-
-		// 将用户信息存入上下文
-		c.Set("user_id", claims.UserID)
-		c.Set("username", claims.Username)
-
-		c.Next()
-	}
-}
+// Package middleware 提供路由层中间件。
+//
+// 注意：旧的 Auth/OptionalAuth 函数已被 auth_pipeline.go 中的
+// RequireAuth / OptionalAuth 替代，新版本内置令牌类型校验、账户状态校验与会话校验。
+// 路由层应使用 RequireAuth(jwt, idp, cache) 与 OptionalAuth(jwt, idp, cache)。
+package middleware