refactor(core): align with cordis spatiotemporal composability architecture

- Purify core micro-kernel by removing context hardcoded helpers and reverse dependencies
- Eliminate init() side effects in infra plugins with reversible lifecycle disposal
- Completely isolate plugins by removing cross-plugin imports and using core/contracts
- Introduce TaskService and RiskControlService contracts for unified cross-plugin APIs
- Regenerate Swagger documentation and update developer guide matrix
- Achieve 0 violations in check_cordis_architecture.sh and 100% test pass

backend/plugins/domain/user/handlers.go

@@ -12,10 +12,11 @@ import (
 	"strconv"
 	"time"
 
-	"Wavelet/core/contracts"
-	"Wavelet/pkg/response"
 	"github.com/gin-contrib/sessions"
 	"github.com/gin-gonic/gin"
+
+	"Wavelet/core/contracts"
+	"Wavelet/pkg/response"
 )
 
 type loginRequest struct {

backend/plugins/domain/user/plugin.go

@@ -9,11 +9,12 @@ import (
 	"embed"
 	"reflect"
 
+	"github.com/gin-gonic/gin"
+	"github.com/hibiken/asynq"
+
 	"Wavelet/core"
 	"Wavelet/core/contracts"
 	"Wavelet/core/extpoints"
-	"github.com/gin-gonic/gin"
-	"github.com/hibiken/asynq"
 )
 
 //go:embed migrations/*.sql
@@ -74,8 +75,16 @@ func (p *Plugin) Manifest() core.Manifest {
 func (p *Plugin) Apply(ctx *core.Context) error {
 	// 0. Bind DBService from Context
 	if db, err := core.Inject[contracts.DBService](ctx); err == nil && db != nil {
-		setDBService(db)
+		SetDBService(db)
+	} else {
+		core.When[contracts.DBService](ctx, func(db contracts.DBService) {
+			SetDBService(db)
+		})
 	}
+	ctx.OnDispose(func() error {
+		SetDBService(nil)
+		return nil
+	})
 
 	// 0.1 Resolve auth service for middleware (via IoC, not direct import)
 	var loginMW gin.HandlerFunc = func(c *gin.Context) { c.Next() }

backend/plugins/domain/user/repository.go

@@ -8,11 +8,11 @@ import (
 	"strings"
 	"sync"
 
+	"gorm.io/gorm"
+
 	"Wavelet/core"
 	"Wavelet/core/contracts"
 	"Wavelet/pkg/util"
-	database "Wavelet/plugins/infra/database"
-	"gorm.io/gorm"
 )
 
 var (
@@ -20,7 +20,8 @@ var (
 	dbSvc contracts.DBService
 )
 
-func setDBService(s contracts.DBService) {
+// SetDBService sets the active DBService contract for the user domain plugin.
+func SetDBService(s contracts.DBService) {
 	dbMu.Lock()
 	defer dbMu.Unlock()
 	dbSvc = s
@@ -28,7 +29,7 @@ func setDBService(s contracts.DBService) {
 
 func getDB(ctx context.Context) *gorm.DB {
 	if c, ok := ctx.(*core.Context); ok && c != nil {
-		if s := c.DB(); s != nil {
+		if s, err := core.Inject[contracts.DBService](c); err == nil && s != nil {
 			return s.DB(ctx)
 		}
 	}
@@ -40,8 +41,7 @@ func getDB(ctx context.Context) *gorm.DB {
 		return s.DB(ctx)
 	}
 
-	// Fallback for standalone CLI commands running without core.App
-	return database.DB(ctx)
+	return nil
 }
 
 // GetUserByID 通过 ID 获取用户

backend/plugins/domain/user/service.go

@@ -11,10 +11,11 @@ import (
 	"strings"
 	"time"
 
+	"gorm.io/gorm"
+
 	"Wavelet/core"
 	"Wavelet/core/contracts"
 	"Wavelet/pkg/idgen"
-	"gorm.io/gorm"
 
 	pkgu "Wavelet/pkg/util"
 )