feat: add Sense identity RBAC and audit (#22)

Sense/server/cmd/sense/modules_identity.go

@@ -0,0 +1,42 @@
+package sense
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"yovision.local/sense/app/sense/identity"
+	"yovision.local/sense/internal/platform"
+)
+
+func init() {
+	registerModule(func(app *platform.App) error {
+		memoryMode := app.Config().DatabaseMode == platform.DatabaseModeMemory
+		key, err := identity.SigningKeyOrRandom(os.Getenv("SENSE_IDENTITY_SIGNING_KEY"), memoryMode)
+		if err != nil {
+			return err
+		}
+		cfg := identity.Config{
+			SigningKey:     key,
+			BootstrapToken: os.Getenv("SENSE_BOOTSTRAP_TOKEN"),
+			SecureCookie:   identity.SecureCookieFromEnvironment(os.Getenv("SENSE_COOKIE_SECURE"), memoryMode),
+			SessionTTL:     8 * time.Hour,
+		}
+		var store identity.Store
+		if memoryMode {
+			store = identity.NewMemoryStore()
+		} else {
+			if cfg.BootstrapToken == "" {
+				return fmt.Errorf("SENSE_BOOTSTRAP_TOKEN is required until secure initialization is completed")
+			}
+			store = identity.NewPostgresStore(app.Database())
+		}
+		service, err := identity.NewService(store, cfg)
+		if err != nil {
+			return err
+		}
+		app.RegisterMigration(platform.Migration{Version: 2026081201, Name: "sense_identity", SQL: identity.MigrationSQL})
+		identity.NewModule(service, cfg).Register(app)
+		return nil
+	})
+}