feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/pkg/auth/cache.go

@@ -0,0 +1,22 @@
+package auth
+
+import "with_you/internal/cache"
+
+// InvalidatePrincipalCache 失效用户的 Principal 缓存。
+//
+// 供角色变更、账户状态变更、登出等场景调用：让 RequireAuth 在下一次请求
+// 重新从 IDP 加载用户与角色。键定义在本包以避免 service → middleware 的包循环。
+func InvalidatePrincipalCache(cch cache.Cache, userID string) {
+	if cch == nil || userID == "" {
+		return
+	}
+	cch.Delete(PrincipalCacheKey(userID))
+}
+
+// InvalidateSessionCache 失效会话有效性缓存。
+func InvalidateSessionCache(cch cache.Cache, sessionID string) {
+	if cch == nil || sessionID == "" {
+		return
+	}
+	cch.Delete(SessionCacheKey(sessionID))
+}