feat(security): complete P0 release blocking remediation

Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.

cmd/bizdev-cli/main.go

@@ -80,7 +80,11 @@ func main() {
 		cfg.AgentBackend = *backend
 	}
 
-	svc := bizdev.NewService(cfg)
+	svc, err := bizdev.NewService(cfg)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "NewService: %v\n", err)
+		os.Exit(1)
+	}
 
 	// 0. 列出支持的阶段
 	if *listStages {

cmd/recategorize/main.go

@@ -22,7 +22,11 @@ func main() {
 		os.Exit(1)
 	}
 
-	svc := bizdev.NewService(cfg)
+	svc, err := bizdev.NewService(cfg)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "NewService: %v\n", err)
+		os.Exit(1)
+	}
 	ctxMgr := svc.ContextManager()
 	if ctxMgr == nil {
 		fmt.Fprintf(os.Stderr, "ContextManager 未初始化\n")

cmd/server/main.go

@@ -38,7 +38,11 @@ func main() {
 		cfg.AgentBackend = *backend
 	}
 
-	svc := bizdev.NewService(cfg)
+	svc, err := bizdev.NewService(cfg)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "业务服务初始化失败: %v\n", err)
+		os.Exit(1)
+	}
 	srv := server.NewServer(cfg, svc)
 
 	addr := fmt.Sprintf("%s:%d", cfg.HTTPHost, cfg.HTTPPort)