feat: auth service + security audit fixes + cleanup legacy services

Major changes:
- Add auth-svc: JWT auth, register/login/refresh, password reset
- Add auth UI: modals, pages (/login, /register, /forgot-password)
- Add usage tracking (usage_metrics table, daily limits)
- Add tiered rate limiting (free/pro/business)
- Add LLM usage limits per tier

Security fixes:
- All repos now require userID for Update/Delete operations
- JWT middleware in chat-svc, llm-svc, agent-svc, discover-svc
- ErrNotFound/ErrForbidden errors for proper access control

Cleanup:
- Remove legacy TypeScript services/ directory
- Remove computer-svc (to be reimplemented)
- Remove old deploy/docker configs

New files:
- backend/cmd/auth-svc/main.go
- backend/internal/auth/{types,repository}.go
- backend/internal/usage/{types,repository}.go
- backend/pkg/middleware/{llm_limits,ratelimit_tiered}.go
- backend/webui/src/components/auth/*
- backend/webui/src/app/(auth)/*

Made-with: Cursor

backend/deploy/k8s/computer-svc.yaml

@@ -1,137 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: computer-svc
-  namespace: gooseek
-  labels:
-    app: computer-svc
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: computer-svc
-  template:
-    metadata:
-      labels:
-        app: computer-svc
-    spec:
-      containers:
-        - name: computer-svc
-          image: gooseek/backend:latest
-          command: ["/app/computer-svc"]
-          ports:
-            - containerPort: 3030
-          env:
-            - name: COMPUTER_SVC_PORT
-              value: "3030"
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: DATABASE_URL
-            - name: REDIS_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: gooseek-config
-                  key: REDIS_URL
-            - name: OPENAI_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: OPENAI_API_KEY
-            - name: ANTHROPIC_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: ANTHROPIC_API_KEY
-                  optional: true
-            - name: GEMINI_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: GEMINI_API_KEY
-                  optional: true
-            - name: TELEGRAM_BOT_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: TELEGRAM_BOT_TOKEN
-                  optional: true
-            - name: SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: SMTP_HOST
-                  optional: true
-            - name: SMTP_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: SMTP_USERNAME
-                  optional: true
-            - name: SMTP_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: SMTP_PASSWORD
-                  optional: true
-            - name: S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: S3_ENDPOINT
-                  optional: true
-            - name: S3_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: S3_ACCESS_KEY
-                  optional: true
-            - name: S3_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: gooseek-secrets
-                  key: S3_SECRET_KEY
-                  optional: true
-            - name: SANDBOX_IMAGE
-              value: "gooseek/sandbox:latest"
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 3030
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 3030
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          volumeMounts:
-            - name: docker-socket
-              mountPath: /var/run/docker.sock
-      volumes:
-        - name: docker-socket
-          hostPath:
-            path: /var/run/docker.sock
-            type: Socket
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: computer-svc
-  namespace: gooseek
-spec:
-  selector:
-    app: computer-svc
-  ports:
-    - port: 3030
-      targetPort: 3030
-  type: ClusterIP

backend/deploy/k8s/kustomization.yaml

@@ -18,7 +18,6 @@ resources:
   - collection-svc.yaml
   - file-svc.yaml
   - thread-svc.yaml
-  - computer-svc.yaml
   - ingress.yaml
 
 commonLabels: