feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/repository/message_repo.go

@@ -26,6 +26,10 @@ type MessageRepository interface {
 	GetMessagesBeforeSeq(conversationID string, beforeSeq int64, limit int) ([]*model.Message, error)
 	GetConversationParticipants(conversationID string) ([]*model.ConversationParticipant, error)
 	GetParticipant(conversationID string, userID string) (*model.ConversationParticipant, error)
+	// GetParticipantStrict 纯查询：返回用户在某会话中的参与者记录。
+	// 不存在时返回 gorm.ErrRecordNotFound，**不会**创建记录。
+	// 用于鉴权场景（如校验非会话参与者不能读取消息），避免 GetParticipant 的自动创建副作用造成鉴权绕过。
+	GetParticipantStrict(conversationID string, userID string) (*model.ConversationParticipant, error)
 	UpdateLastReadSeq(conversationID string, userID string, lastReadSeq int64) error
 	UpdatePinned(conversationID string, userID string, isPinned bool) error
 	UpdateNotificationMuted(conversationID string, userID string, notificationMuted bool) error
@@ -253,6 +257,10 @@ func (r *messageRepository) GetConversationParticipants(conversationID string) (
 
 // GetParticipant 获取用户在会话中的参与者信息
 // userID 参数为 string 类型（UUID格式），与JWT中user_id保持一致
+//
+// 注意：本方法在参与者记录不存在但会话存在时会**自动创建**参与者记录。
+// 该副作用适用于"确保参与者存在"的写路径；鉴权/读取路径应改用 GetParticipantStrict，
+// 否则非参与者的查询会被静默升级为成员（鉴权绕过）。
 func (r *messageRepository) GetParticipant(conversationID string, userID string) (*model.ConversationParticipant, error) {
 	var participant model.ConversationParticipant
 	err := r.db.Where("conversation_id = ? AND user_id = ?", conversationID, userID).First(&participant).Error
@@ -278,6 +286,17 @@ func (r *messageRepository) GetParticipant(conversationID string, userID string)
 	return &participant, nil
 }
 
+// GetParticipantStrict 纯查询参与者记录，不存在即返回 gorm.ErrRecordNotFound，不创建。
+//
+// 用于鉴权：避免 GetParticipant 的"自动创建"副作用把非成员静默升级为成员。
+func (r *messageRepository) GetParticipantStrict(conversationID string, userID string) (*model.ConversationParticipant, error) {
+	var participant model.ConversationParticipant
+	if err := r.db.Where("conversation_id = ? AND user_id = ?", conversationID, userID).First(&participant).Error; err != nil {
+		return nil, err
+	}
+	return &participant, nil
+}
+
 // UpdateLastReadSeq 更新已读位置（防回退：仅当新值大于当前值时才更新）
 // userID 参数为 string 类型（UUID格式），与JWT中user_id保持一致
 func (r *messageRepository) UpdateLastReadSeq(conversationID string, userID string, lastReadSeq int64) error {