feat(app): add plugin system with auth plugin and static assets

Add new application structure:
- app/main.py - application entry point
- app/plugins/ - plugin system with auth plugin:
  - api/ - REST API endpoints and schemas
  - authorization/ - auth policies, providers, hooks
  - domain/ - business logic (service, models, jwt, password)
  - injection/ - route injection and guards
  - ops/ - operational utilities
  - runtime/ - runtime configuration
  - security/ - middleware, CSRF, dependencies
  - storage/ - user repositories and models
- app/static/ - static assets (scalar.js for API docs)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/plugins/auth/security/actor_context.py

@@ -0,0 +1,43 @@
+"""Auth-plugin bridge from request user to runtime actor context."""
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+
+from fastapi import Request
+
+from deerflow.runtime.actor_context import ActorContext, bind_actor_context, reset_actor_context
+
+
+def resolve_request_user_id(request: Request) -> str | None:
+    scope = getattr(request, "scope", None)
+    user = scope.get("user") if isinstance(scope, dict) else None
+    if user is None:
+        state = getattr(request, "state", None)
+        state_vars = vars(state) if state is not None and hasattr(state, "__dict__") else {}
+        user = state_vars.get("user")
+    user_id = getattr(user, "id", None)
+    if user_id is None:
+        return None
+    return str(user_id)
+
+
+@contextmanager
+def bind_request_actor_context(request: Request):
+    token = bind_actor_context(ActorContext(user_id=resolve_request_user_id(request)))
+    try:
+        yield
+    finally:
+        reset_actor_context(token)
+
+
+@contextmanager
+def bind_user_actor_context(user_id: str | None):
+    token = bind_actor_context(ActorContext(user_id=str(user_id) if user_id is not None else None))
+    try:
+        yield
+    finally:
+        reset_actor_context(token)
+
+
+__all__ = ["bind_request_actor_context", "bind_user_actor_context", "resolve_request_user_id"]