refactor(数据库): 迁移持久层到 Ent 并清理 GORM

将仓储层/基础设施改为 Ent + 原生 SQL 执行路径，并移除 AutoMigrate 与 GORM 依赖。
重构内容包括：
- 仓储层改用 Ent/SQL（含 usage_log/account 等复杂查询），统一错误映射
- 基础设施与 setup 初始化切换为 Ent + SQL migrations
- 集成测试与 fixtures 迁移到 Ent 事务模型
- 清理遗留 GORM 模型/依赖，补充迁移与文档说明
- 增加根目录 Makefile 便于前后端编译

测试：
- go test -tags unit ./...
- go test -tags integration ./...

deploy/README.md

@@ -51,7 +51,7 @@ When using Docker Compose with `AUTO_SETUP=true`:
 
 1. On first run, the system automatically:
    - Connects to PostgreSQL and Redis
-   - Creates all database tables
+   - Applies database migrations (SQL files in `backend/migrations/*.sql`) and records them in `schema_migrations`
    - Generates JWT secret (if not provided)
    - Creates admin account (password auto-generated if not provided)
    - Writes config.yaml
@@ -63,6 +63,30 @@ When using Docker Compose with `AUTO_SETUP=true`:
    docker-compose logs sub2api | grep "admin password"
    ```
 
+### Database Migration Notes (PostgreSQL)
+
+- Migrations are applied in lexicographic order (e.g. `001_...sql`, `002_...sql`).
+- `schema_migrations` tracks applied migrations (filename + checksum).
+- Migrations are forward-only; rollback requires a DB backup restore or a manual compensating SQL script.
+
+**Verify `users.allowed_groups` → `user_allowed_groups` backfill**
+
+During the incremental GORM→Ent migration, `users.allowed_groups` (legacy `BIGINT[]`) is being replaced by a normalized join table `user_allowed_groups(user_id, group_id)`.
+
+Run this query to compare the legacy data vs the join table:
+
+```sql
+WITH old_pairs AS (
+  SELECT DISTINCT u.id AS user_id, x.group_id
+  FROM users u
+  CROSS JOIN LATERAL unnest(u.allowed_groups) AS x(group_id)
+  WHERE u.allowed_groups IS NOT NULL
+)
+SELECT
+  (SELECT COUNT(*) FROM old_pairs)           AS old_pair_count,
+  (SELECT COUNT(*) FROM user_allowed_groups) AS new_pair_count;
+```
+
 ### Commands
 
 ```bash