feat(auth): implement session-based token management with revocation support

Add Session model, SessionService, and SessionRepository to track user login
sessions and enable token revocation on auth-critical events.

- Introduce explicit TokenType (access/refresh) in JWT claims to prevent
  refresh token misuse via access token endpoints
- Add SessionID field to JWT claims, enabling stateless JWT validation
  against revoked sessions
- Replace legacy Auth middleware with RequireAuth/OptionalAuth pipeline
  that validates token type, account status, and session validity
- Implement session revocation on password change, reset, user ban/inactive,
  and explicit logout
- Add Principal cache with active invalidation for banned/role-changed users
- Fix IDOR vulnerability: GetMessagesByCursor now validates currentUserID
  is conversation participant via GetParticipantStrict
- Add group member visibility checks: announcements, group info, member list
  now require group membership
- Simplify Casbin policy: remove g grouping, use r.sub == p.sub matcher
  with globMatch; user_roles table is single source of truth for roles
- Add migration logic to clean legacy casbin g rules and migrate old p rules
  from path-style to admin/<domain> resource naming

internal/service/role_service.go

@@ -96,6 +96,19 @@ func (s *roleService) AssignRole(ctx context.Context, operatorID, targetUserID,
 		return apperrors.ErrCannotModifyOwnRole
 	}
 
+	// 纵深防御：分配 super_admin 仅 super_admin 自身可操作。
+	// 路由层 Authorize 已通过 admin.users.roles 限制 super_admin 能拿到此动作，
+	// 这里再独立校验 operator 角色，防止路由策略错配或服务被其他路径调用造成提权。
+	if role == model.RoleSuperAdmin {
+		roles, err := s.casbinSvc.GetRolesForUser(ctx, operatorID)
+		if err != nil {
+			return apperrors.ErrCasbinInternal
+		}
+		if !containsRole(roles, model.RoleSuperAdmin) {
+			return apperrors.ErrCannotModifySuperAdmin
+		}
+	}
+
 	// 检查目标用户是否已有该角色
 	hasRole, err := s.casbinSvc.HasRoleForUser(ctx, targetUserID, role)
 	if err != nil {
@@ -126,6 +139,8 @@ func (s *roleService) RemoveRole(ctx context.Context, operatorID, targetUserID,
 		return apperrors.ErrCannotModifySuperAdmin
 	}
 
+	// 纵深防御：移除其他用户的 super_admin 角色同样要求 operator 是 super_admin。
+	// （role==super_admin 已被上面拦截，这里针对未来扩展：如果允许移除其他高优先级角色再加规则。）
 	// 检查用户是否有该角色
 	hasRole, err := s.casbinSvc.HasRoleForUser(ctx, targetUserID, role)
 	if err != nil {
@@ -138,6 +153,16 @@ func (s *roleService) RemoveRole(ctx context.Context, operatorID, targetUserID,
 	return s.casbinSvc.DeleteRoleForUser(ctx, targetUserID, role)
 }
 
+// containsRole 检查角色集合中是否包含指定角色。
+func containsRole(roles []string, role string) bool {
+	for _, r := range roles {
+		if r == role {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *roleService) GetAllRoles(ctx context.Context) ([]model.Role, error) {
 	return s.roleRepo.GetAllRoles(ctx)
 }