feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/pkg/response/response.go

@@ -131,15 +131,17 @@ func HandleError(c *gin.Context, err error, defaultMessage string) {
 func statusCodeFromAppErrorCode(code string) int {
 	switch code {
 	case "NOT_FOUND", "USER_NOT_FOUND", "POST_NOT_FOUND", "GROUP_NOT_FOUND",
-		"GROUP_REQUEST_NOT_FOUND", "SCHEDULE_COURSE_NOT_FOUND":
+		"GROUP_REQUEST_NOT_FOUND", "SCHEDULE_COURSE_NOT_FOUND",
+		"VERIFICATION_NOT_FOUND", "CALL_NOT_FOUND":
 		return http.StatusNotFound
-	case "UNAUTHORIZED":
+	case "UNAUTHORIZED", "INVALID_TOKEN", "TOKEN_EXPIRED", "SESSION_REVOKED":
 		return http.StatusUnauthorized
 	case "INVALID_CREDENTIALS":
 		return http.StatusBadRequest
 	case "FORBIDDEN", "NOT_GROUP_MEMBER", "NOT_GROUP_ADMIN", "NOT_GROUP_OWNER",
 		"USER_BANNED", "USER_BLOCKED", "MUTED", "MUTE_ALL_ENABLED",
 		"SCHEDULE_FORBIDDEN", "UNAUTHORIZED_NOTIFICATION",
+		"ACCOUNT_INACTIVE", "WRONG_TOKEN_TYPE", "VERIFICATION_REQUIRED",
 		"SETUP_ALREADY_COMPLETED":
 		return http.StatusForbidden
 	case "BAD_REQUEST", "INVALID_USERNAME", "INVALID_EMAIL", "INVALID_PHONE",