feat(task1): restructure directories for turborepo monorepo

- Move backend/ to apps/server/ via git mv
- Move frontend/ to apps/admin/ via git mv
- Create packages/typescript-config/ with base, nestjs, and react-vite presets

apps/server/src/auth/guards/jwt-auth.guard.ts

@@ -0,0 +1,5 @@
+import { Injectable, ExecutionContext } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {}

apps/server/src/auth/guards/permission.guard.ts

@@ -0,0 +1,34 @@
+import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
+import { PERMISSION_KEY } from '../decorators/permission.decorator';
+
+@Injectable()
+export class PermissionGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    // 1. @Public() 豁免
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+
+    // 2. 获取所需权限（getAllAndMerge 合并 handler+class 层的所有 metadata）
+    const requiredPermissions = this.reflector.getAllAndMerge<string[]>(
+      PERMISSION_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    // 无装饰器 = 默认拒绝
+    if (!requiredPermissions || requiredPermissions.length === 0) return false;
+
+    // 3. 从 JWT payload 获取用户权限
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user || !user.permissions || !Array.isArray(user.permissions)) return false;
+
+    // 4. OR 匹配：用户拥有 requiredPermissions 中任一权限即可通过
+    return requiredPermissions.some(p => user.permissions.includes(p));
+  }
+}