Merge remote-tracking branch 'wavelet/feat/cordis-alignment' into cordis

# Conflicts:
#	.agents/skills/cache-framework/SKILL.md
#	.agents/skills/clickhouse-batchwriter/SKILL.md
#	.agents/skills/database-migration/SKILL.md
#	.agents/skills/file-upload/SKILL.md
#	.agents/skills/logstore/SKILL.md
#	.agents/skills/new-api/SKILL.md
#	.agents/skills/new-api/references/handler_example.go
#	.agents/skills/new-api/references/logics_example.go
#	.agents/skills/new-api/references/service_example.go
#	.agents/skills/new-async-task/SKILL.md
#	.agents/skills/new-async-task/references/CODE-EXAMPLES.md
#	.agents/skills/new-setting/SKILL.md
#	.agents/skills/push-notification/SKILL.md
#	.agents/skills/release-guide/SKILL.md
#	.auto/checks.sh
#	.auto/ideas.md
#	.auto/log.jsonl
#	.auto/measure.sh
#	.auto/prompt.md
#	.dockerignore
#	.env.example
#	.github/copilot-instructions.md
#	.github/workflows/build-release.yml
#	.gitignore
#	.golangci.yml
#	AGENTS.md
#	Makefile
#	README.md
#	backend/cmd/app.go
#	backend/cmd/app_test.go
#	backend/cmd/banner.go
#	backend/cmd/banner_test.go
#	backend/docs/docs.go
#	backend/docs/swagger.json
#	backend/docs/swagger.yaml
#	backend/go.mod
#	backend/go.sum
#	backend/main.go
#	config.example.yaml
#	docker/Dockerfile
#	docker/Dockerfile.backend
#	docker/Dockerfile.cross
#	scripts/swagger.sh
#	scripts/update_go_license.sh

backend/downstream/README.md

@@ -0,0 +1,77 @@
+# Downstream Custom Plugins
+
+This directory is the designated location for downstream (deployment-specific) Cordis plugins.
+
+## Architecture
+
+```
+downstream/
+├── README.md
+└── plugins/
+    └── custom_example/       # Example plugin — copy & rename to get started
+        └── plugin.go
+```
+
+Downstream plugins follow the same `core.Plugin` contract as platform plugins:
+
+```go
+type Plugin interface {
+    Name() string
+    Apply(ctx *core.Context) error
+}
+```
+
+## Rules
+
+1. **Naming**: Each plugin directory name becomes its import path and plugin ID (kebab-case recommended).
+2. **Dependencies**: Downstream plugins may import `core/`, `core/contracts/`, `pkg/`, and `plugins/infra/` packages from the platform. They MUST NOT import domain plugin internal packages — use `core.Inject[contracts.XxxService](ctx)` instead.
+3. **Registration**: Add your downstream plugin to `cmd/app.go` before the platform plugins or after, depending on which services it needs:
+   ```go
+   // newWaveletApp in cmd/app.go
+   app.Use(
+       database.New(),
+       cache.New(),
+       logger.New(),
+       storage.New(),
+       // ... platform domain plugins ...
+       custom_hello.New(), // your downstream plugin
+       driver_http.New(),
+       driver_asynq_worker.New(),
+       driver_asynq_cron.New(),
+   )
+   ```
+4. **Migration**: If your plugin needs database tables, embed SQL files in a `migrations/` directory and register via `ctx.Migrations().Register(...)` in `Apply()`.
+
+## Quick Start
+
+```go
+package custom_example
+
+import (
+    "github.com/Rain-kl/Wavelet/core"
+    "github.com/Rain-kl/Wavelet/core/contracts"
+    "github.com/gin-gonic/gin"
+)
+
+type Plugin struct{}
+
+func New() *Plugin { return &Plugin{} }
+
+func (p *Plugin) Name() string { return "custom_example" }
+
+func (p *Plugin) Apply(ctx *core.Context) error {
+    // Example: register a route that uses AuthService
+    var authSvc contracts.AuthService
+    if err := ctx.Using(func(svc contracts.AuthService) { authSvc = svc }); err != nil {
+        return err
+    }
+
+    g := ctx.Router().Group("/api/v1/custom", authSvc.RequireAuthMiddleware().(gin.HandlerFunc))
+    g.GET("/hello", func(c *gin.Context) {
+        user, _ := authSvc.GetCurrentUser(c.Request.Context())
+        c.JSON(200, gin.H{"message": "Hello " + user.Username})
+    })
+
+    return nil
+}
+```

backend/downstream/plugins/custom_example/plugin.go

@@ -0,0 +1,50 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package custom_example demonstrates how to build a downstream Cordis plugin.
+// Copy this directory to create your own plugin.
+package custom_example
+
+import (
+	"Wavelet/core"
+	"Wavelet/core/contracts"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Plugin implements core.Plugin for the custom_example downstream plugin.
+type Plugin struct{}
+
+// New creates a new custom_example plugin.
+func New() *Plugin {
+	return &Plugin{}
+}
+
+// Name returns the unique identifier for this plugin.
+func (p *Plugin) Name() string {
+	return "custom_example"
+}
+
+// Apply registers routes and services into the Cordis micro-kernel Context.
+func (p *Plugin) Apply(ctx *core.Context) error {
+	// Resolve platform services via IoC container (no direct imports of domain plugins).
+	var authSvc contracts.AuthService
+	if err := core.Using[contracts.AuthService](ctx, func(svc contracts.AuthService) { authSvc = svc }); err != nil {
+		return err
+	}
+	_ = authSvc
+
+	// Register routes using the auth middleware obtained through the contract.
+	g := ctx.Router().Group("/api/v1/custom", authSvc.RequireAuthMiddleware().(gin.HandlerFunc))
+	g.GET("/hello", func(c *gin.Context) {
+		user, err := authSvc.GetCurrentUser(c.Request.Context())
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"message": "Hello " + user.Username})
+	})
+
+	return nil
+}