refactor(core): fix cross-domain auth imports, unify migration, add downstream scaffold

Architecture:
- Move GetFromContext/SetToContext from plugins/domain/auth to pkg/util
- Move auth context key constants to core/contracts (AuthUserObjKey, AuthTokenAuthKey, etc.)
- Add AuthUserIDKey, AuthUserNameKey, GetCurrentUserID, RevokeToken to contracts.AuthService
- All 4 domain plugin Apply() methods now resolve AuthService via core.Using IoC
- Plugin route middleware uses authSvc.RequireAuthMiddleware() cast to gin.HandlerFunc
- DisallowTokenAuth added to AuthService contract

Migration:
- Replace cmd/app.go SetMigrationRunner bridge with gooseEngine implementing core.MigrationEngine
- Remove cmd/root.go PreRun migration hooks and runMigrations() function
- Migrations now run via core.App.Start() → RunMigrations()

Events:
- Add complete domain event topic catalog and payload DTOs to core/contracts/events.go
- 15 event topics across auth, user, admin, upload, message_gateway, risk_control

Downstream:
- Create downstream/ directory with README and custom_example plugin scaffold

CI:
- Update Makefile code-check architecture guards for Cordis layering
- Enforce: core no gin/gorm/asynq, contracts no plugins/, pkg no plugins/, domain no cross-domain

Makefile

@@ -36,10 +36,32 @@ build-embedded:
 code-check:
 	@echo "==> Architecture guards..."
 	@command -v rg >/dev/null 2>&1 || { echo 'error: rg (ripgrep) is required for architecture guards' >&2; exit 1; }
-	@if [ -d pkg/model ] && rg -n 'database\.DB\(|cachepkg\.Redis' pkg/model --glob '*.go' -g '!*_test.go' ; then \
-		echo 'error: pkg/model must not access database.DB or cachepkg.Redis (non-test code)' >&2; \
+	@echo "  → core/ must not import gin, gorm, asynq..."
+	@if rg -n '"github.com/gin-gonic/gin|"gorm.io/gorm|"github.com/hibiken/asynq' core/ --glob '*.go' -g '!*_test.go' 2>/dev/null; then \
+		echo 'error: core/ must not import gin, gorm, or asynq' >&2; \
 		exit 1; \
 	fi
+	@echo "  → core/contracts/ must not import plugins/..."
+	@if rg -n 'plugins/' core/contracts --glob '*.go' 2>/dev/null; then \
+		echo 'error: core/contracts/ must not import plugins/' >&2; \
+		exit 1; \
+	fi
+	@echo "  → pkg/ must not import plugins/..."
+	@if rg -n 'plugins/' pkg --glob '*.go' -g '!*_test.go' 2>/dev/null; then \
+		echo 'error: pkg/ must not import plugins/' >&2; \
+		exit 1; \
+	fi
+	@echo "  → plugins/domain/ must not import other plugins/domain/..."
+	@for d in plugins/domain/*/; do \
+		name=$$(basename $$d); \
+		imports=$$(rg -n '"github.com/Rain-kl/Wavelet/plugins/domain/' plugins/domain/"$$name" -g '*.go' 2>/dev/null | rg -v "plugins/domain/$$name/" | rg -v '_test.go' || true); \
+		if [ -n "$$imports" ]; then \
+			echo "error: plugins/domain/$$name must not import other domain plugins" >&2; \
+			echo "$$imports" >&2; \
+			exit 1; \
+		fi; \
+	done
+	@echo "  → Architecture guards PASS"
 	golangci-lint run
 	cd frontend && pnpm tsc --noEmit --jsx preserve && npx eslint . --max-warnings 0