refactor(core): fix cross-domain auth imports, unify migration, add downstream scaffold

Architecture:
- Move GetFromContext/SetToContext from plugins/domain/auth to pkg/util
- Move auth context key constants to core/contracts (AuthUserObjKey, AuthTokenAuthKey, etc.)
- Add AuthUserIDKey, AuthUserNameKey, GetCurrentUserID, RevokeToken to contracts.AuthService
- All 4 domain plugin Apply() methods now resolve AuthService via core.Using IoC
- Plugin route middleware uses authSvc.RequireAuthMiddleware() cast to gin.HandlerFunc
- DisallowTokenAuth added to AuthService contract

Migration:
- Replace cmd/app.go SetMigrationRunner bridge with gooseEngine implementing core.MigrationEngine
- Remove cmd/root.go PreRun migration hooks and runMigrations() function
- Migrations now run via core.App.Start() → RunMigrations()

Events:
- Add complete domain event topic catalog and payload DTOs to core/contracts/events.go
- 15 event topics across auth, user, admin, upload, message_gateway, risk_control

Downstream:
- Create downstream/ directory with README and custom_example plugin scaffold

CI:
- Update Makefile code-check architecture guards for Cordis layering
- Enforce: core no gin/gorm/asynq, contracts no plugins/, pkg no plugins/, domain no cross-domain

core/contracts/auth.go

@@ -64,14 +64,23 @@ type AuthService interface {
 	// GetCurrentUser retrieves the authenticated UserDTO from context.
 	GetCurrentUser(ctx context.Context) (*UserDTO, error)
 
+	// GetCurrentUserID retrieves the authenticated user ID from session/context.
+	GetCurrentUserID(ctx context.Context) (uint64, error)
+
 	// VerifyToken validates an access token and returns the associated user DTO.
 	VerifyToken(ctx context.Context, token string) (*UserDTO, error)
 
 	// CreateSession establishes an authenticated session for the given user ID.
 	CreateSession(ctx context.Context, userID uint64, extras map[string]any) (string, error)
 
+	// RevokeToken invalidates a specific access token by its hash.
+	RevokeToken(ctx context.Context, tokenHash string) error
+
 	// RevokeUserSessions revokes all active sessions and cached tokens for a user.
 	RevokeUserSessions(ctx context.Context, userID uint64) error
+
+	// DisallowTokenAuthMiddleware returns a middleware that rejects requests authenticated via access token.
+	DisallowTokenAuthMiddleware() any
 }
 
 // AuthRegistry allows downstream and domain plugins to register custom authentication providers.
@@ -80,3 +89,12 @@ type AuthRegistry interface {
 	GetOAuthProvider(name string) (OAuthProvider, bool)
 	ListOAuthProviders() []string
 }
+
+// Auth context keys — stored in Gin context by auth middleware, consumed by domain plugins.
+const (
+	AuthUserIDKey    = "user_id"
+	AuthUserNameKey  = "username"
+	AuthUserObjKey   = "user_obj"
+	AuthTokenAuthKey = "token_auth"  // marks if request uses access token auth
+	AuthTokenAdminKey = "token_admin" // whether the access token has admin privileges
+)

core/contracts/events.go

@@ -1,13 +1,109 @@
 // Copyright 2026 Arctel.net
 // SPDX-License-Identifier: Apache-2.0
 
+// Package contracts defines unified service interfaces and DTOs for cross-plugin communication.
 package contracts
 
-// EventTopicAdminLoggedIn 管理员登录事件主题
-const EventTopicAdminLoggedIn = "admin:logged_in"
+// ======================================================================
+// Domain Event Topic Constants
+// ======================================================================
+//
+// All cross-plugin domain event topics MUST be declared here so that
+// producers and consumers share the same string values without importing
+// each other's implementation packages.
+// ======================================================================
+
+// --- Auth & User Events ---
+const (
+	// EventTopicAdminLoggedIn fires when an admin user logs in.
+	EventTopicAdminLoggedIn = "admin:logged_in"
+
+	// EventTopicUserCreated fires when a new user account is created.
+	EventTopicUserCreated = "user:created"
+
+	// EventTopicUserUpdated fires when a user profile is updated.
+	EventTopicUserUpdated = "user:updated"
+
+	// EventTopicUserDeleted fires when a user account is deleted.
+	EventTopicUserDeleted = "user:deleted"
+)
+
+// --- Admin & System Events ---
+const (
+	// EventTopicConfigChanged fires when a system configuration value changes.
+	EventTopicConfigChanged = "admin:config_changed"
+
+	// EventTopicSystemCleanup fires when a periodic system cleanup completes.
+	EventTopicSystemCleanup = "admin:system_cleanup"
+)
+
+// --- Upload / Storage Events ---
+const (
+	// EventTopicUploadCreated fires when a new file upload is recorded.
+	EventTopicUploadCreated = "upload:created"
+
+	// EventTopicUploadDeleted fires when a file upload is removed.
+	EventTopicUploadDeleted = "upload:deleted"
+
+	// EventTopicIngestComplete fires when a programmatic file ingest finishes.
+	EventTopicIngestComplete = "upload:ingest_complete"
+)
+
+// --- Message Gateway Events ---
+const (
+	// EventTopicNotificationSent fires when a push notification is dispatched.
+	EventTopicNotificationSent = "message:notification_sent"
+
+	// EventTopicChannelBound fires when a user binds a messaging channel.
+	EventTopicChannelBound = "message:channel_bound"
+
+	// EventTopicChannelUnbound fires when a user unbinds a messaging channel.
+	EventTopicChannelUnbound = "message:channel_unbound"
+)
+
+// --- Risk Control Events ---
+const (
+	// EventTopicAccessLogRecorded fires when a user access log entry is recorded.
+	EventTopicAccessLogRecorded = "risk:access_log_recorded"
+)
+
+// ======================================================================
+// Domain Event Payload DTOs
+// ======================================================================
 
 // AdminLoggedIn 管理员登录领域事件载荷
 type AdminLoggedIn struct {
 	User *UserDTO `json:"user"`
 	IP   string   `json:"ip"`
 }
+
+// UserCreatedEvent fires when a new user account is created.
+type UserCreatedEvent struct {
+	User     *UserDTO `json:"user"`
+	Password string   `json:"-"`
+}
+
+// ConfigChangedEvent fires when a system configuration value changes.
+type ConfigChangedEvent struct {
+	Key    string `json:"key"`
+	OldVal any    `json:"old_val,omitempty"`
+	NewVal any    `json:"new_val,omitempty"`
+}
+
+// UploadCreatedEvent fires when a new file upload is recorded.
+type UploadCreatedEvent struct {
+	UploadID uint64 `json:"upload_id,string"`
+	UserID   uint64 `json:"user_id,string"`
+	FileName string `json:"file_name"`
+	FileSize int64  `json:"file_size"`
+	MimeType string `json:"mime_type"`
+}
+
+// NotificationSentEvent fires when a push notification is dispatched.
+type NotificationSentEvent struct {
+	UserID    uint64 `json:"user_id,string"`
+	Channel   string `json:"channel"`
+	Title     string `json:"title"`
+	Success   bool   `json:"success"`
+	ErrorInfo string `json:"error_info,omitempty"`
+}