feat(security): complete P0 release blocking remediation

Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.

cmd/server/main.go

@@ -38,7 +38,11 @@ func main() {
 		cfg.AgentBackend = *backend
 	}
 
-	svc := bizdev.NewService(cfg)
+	svc, err := bizdev.NewService(cfg)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "业务服务初始化失败: %v\n", err)
+		os.Exit(1)
+	}
 	srv := server.NewServer(cfg, svc)
 
 	addr := fmt.Sprintf("%s:%d", cfg.HTTPHost, cfg.HTTPPort)