feat(gateway): 网关（REST /api/v1 + WS Hub /ws/chat + admin /api/v1/admin/* + JWT/RBAC + 审计，单端口 :8080）

internal/services/gateway/audit.go

@@ -0,0 +1,30 @@
+package gateway
+
+import (
+	"net/http"
+	"time"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
+)
+
+// auditClaims records an admin write with the caller identity read from the
+// request context (populated by auth.Authorize). It is the who/what/when/result
+// audit trail required for admin operations; the "主代理代审" user-facing note is
+// the frontend's job, not the gateway's.
+func (s *Server) auditClaims(r *http.Request, what, result string) {
+	who := "anonymous"
+	if claims, ok := auth.ClaimsFromContext(r.Context()); ok {
+		who = claims.Sub + ":" + string(claims.Role)
+	}
+	s.audit(who, what, result)
+}
+
+// audit emits one structured audit record on the gateway logger.
+func (s *Server) audit(who, what, result string) {
+	s.log.Info("admin audit",
+		"who", who,
+		"what", what,
+		"when", time.Now().UTC().Format(time.RFC3339),
+		"result", result,
+	)
+}