feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/service/admin_user_service.go

@@ -3,8 +3,12 @@ package service
 import (
 	"context"
 
+	"go.uber.org/zap"
+
+	"with_you/internal/cache"
 	"with_you/internal/dto"
 	"with_you/internal/model"
+	"with_you/internal/pkg/auth"
 	"with_you/internal/repository"
 )
 
@@ -19,14 +23,21 @@ type AdminUserService interface {
 }
 
 // adminUserServiceImpl 管理端用户服务实现
+//
+// sessionSvc 与 cache 用于在封禁/停用用户时撤销其全部登录会话并失效 Principal 缓存，
+// 让 RequireAuth 在下一次请求时重新加载用户状态（避免 30s 缓存窗口内仍可访问）。
 type adminUserServiceImpl struct {
-	userRepo repository.UserRepository
+	userRepo   repository.UserRepository
+	sessionSvc SessionService
+	cache      cache.Cache
 }
 
 // NewAdminUserService 创建管理端用户服务
-func NewAdminUserService(userRepo repository.UserRepository) AdminUserService {
+func NewAdminUserService(userRepo repository.UserRepository, sessionSvc SessionService, cache cache.Cache) AdminUserService {
 	return &adminUserServiceImpl{
-		userRepo: userRepo,
+		userRepo:   userRepo,
+		sessionSvc: sessionSvc,
+		cache:      cache,
 	}
 }
 
@@ -74,6 +85,26 @@ func (s *adminUserServiceImpl) UpdateUserStatus(ctx context.Context, userID stri
 		return nil, err
 	}
 
+	// 状态变更后的会话/缓存联动：
+	//   - banned/inactive：撤销该用户全部会话（refresh token 立即失效）并失效 Principal 缓存，
+	//     access token 在剩余 TTL 内仍可用（无状态 JWT 固有限制），但 refresh 已不可续期。
+	//   - active：从封禁恢复时同样失效 Principal 缓存，让下次请求重新加载新状态。
+	// 失败仅告警不阻塞主流程：状态变更本身已成功，缓存最终会自然过期。
+	if status == model.UserStatusBanned || status == model.UserStatusInactive {
+		if s.sessionSvc != nil {
+			if rerr := s.sessionSvc.RevokeAllByUser(ctx, userID); rerr != nil {
+				zap.L().Warn("failed to revoke sessions on user status change",
+					zap.String("user_id", userID),
+					zap.String("status", string(status)),
+					zap.Error(rerr),
+				)
+			}
+		}
+	}
+	if status != user.Status {
+		auth.InvalidatePrincipalCache(s.cache, userID)
+	}
+
 	// 重新获取用户信息
 	user, err = s.userRepo.GetByID(userID)
 	if err != nil {