refactor: complete backend rewrite for multi-protocol proxy

Major rewrite of the Go backend to support:
- Three API format imports: openai, anthropic, compatible
- Three protocol conversions: Chat Completions, Responses, Messages
- Hub-and-spoke architecture with Chat as intermediate format

Deleted:
- opencat.go (old entry)
- store/, team/, pkg/team/, pkg/store/ (old data layer)
- internal/model/, internal/consts/ (old types)
- internal/service/team/, internal/controller/team/ (old handlers)
- llm/ (removed LLM client library, pure proxy mode)
- dist/, assets/ (old build artifacts)

Added:
- internal/store/ — 9 GORM models + multi-DB support
- internal/pkg/ — crypto (AES-GCM), apikey, jwt, ratelimit, resp, tokenizer
- internal/channel/ — channel selection, weighted LB, health checks
- internal/proxy/convert/ — 6 protocol conversion functions + SSE streaming
- internal/proxy/ — gateway with request dispatch and upstream selection
- internal/usage/ — async usage recorder with batch writes
- internal/api/ — management API (auth, users, keys, channels, models)
- Makefile for build/test/deploy

Fixed API to match frontend expectations:
- Login response wraps token in { data: { token } }
- GET /api/profile route added
- Profile response wraps user in { code, data }
- Role returned as number (10=admin, 1=user)

internal/auth/auth.go

@@ -2,14 +2,15 @@ package auth
 
 import (
 	"errors"
-	"opencatd-open/internal/model"
+	"os"
+	"opencatd-open/internal/store"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
 )
 
 type Claims struct {
-	UserID int64  `json:"user_id"`
+	UserID uint64 `json:"user_id"`
 	Name   string `json:"name"`
 	Type   string `json:"type"`
 	jwt.RegisteredClaims
@@ -20,28 +21,23 @@ type TokenPair struct {
 	RefreshToken string `json:"refresh_token,omitempty"`
 }
 
-func GenerateTokenPair(user *model.User, secret string, accessExpire, refreshExpire time.Duration) (*TokenPair, error) {
-	// Generate access token
+func GenerateTokenPair(user *store.User, secret string, accessExpire, refreshExpire time.Duration) (*TokenPair, error) {
 	accessToken, err := generateToken(user, "access", secret, accessExpire)
 	if err != nil {
 		return nil, err
 	}
-
-	// Generate refresh token
 	refreshToken, err := generateToken(user, "refresh", secret, refreshExpire)
 	if err != nil {
 		return nil, err
 	}
-
 	return &TokenPair{
 		AccessToken:  accessToken,
 		RefreshToken: refreshToken,
 	}, nil
 }
 
-func generateToken(user *model.User, tokenType, secret string, expire time.Duration) (string, error) {
+func generateToken(user *store.User, tokenType, secret string, expire time.Duration) (string, error) {
 	now := time.Now()
-
 	claims := Claims{
 		UserID: user.ID,
 		Name:   user.Username,
@@ -52,7 +48,6 @@ func generateToken(user *model.User, tokenType, secret string, expire time.Durat
 			NotBefore: jwt.NewNumericDate(now),
 		},
 	}
-
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(secret))
 }
@@ -64,14 +59,20 @@ func ValidateToken(tokenString, secret string) (*Claims, error) {
 		}
 		return []byte(secret), nil
 	})
-
 	if err != nil {
 		return nil, err
 	}
-
 	if claims, ok := token.Claims.(*Claims); ok && token.Valid {
 		return claims, nil
 	}
-
 	return nil, jwt.ErrInvalidKey
 }
+
+// GetSecretKey returns the JWT secret key from environment or config
+func GetSecretKey() string {
+	secret := os.Getenv("SECRET_KEY")
+	if secret == "" {
+		secret = "default-secret-key-change-in-production"
+	}
+	return secret
+}