Task: Complete remaining Go backend modules

Identity

Complete every ADR-003 Go backend module that remains after the foundation, database-refreshed identity, current-session HTTP, and password login/logout slices already present at the task base.
Freeze language-neutral compatibility contracts before each remaining vertical slice and keep the TypeScript implementation as an executable source-of-truth consumer until cutover.
Implement the remaining Identity and Administration behavior; Assets and storage/file serving; Billing and Usage; Jobs, providers, Webhooks, and the embedded WorkerLoop; and the remaining public/compatibility HTTP surface.
Compose all migrated routes into the separately runnable Go application and prove route-surface coverage without moving production traffic.
Keep production cutover, Next Route Handler deletion, Node Worker drain, Docker/ACK/Ingress ownership changes, and real RDS/OSS rollout outside this feature task.

Follow vertical red-green TDD at stable external HTTP Interfaces and deep domain/Adapter seams; do not create one shallow repository Interface per table.
Preserve current same-origin paths, method/status/JSON behavior, Cookie and tenant authorization, owner-scoped not-found behavior, idempotency, job state, wallet arithmetic, storage metadata, provider, and Webhook semantics.
Keep PostgreSQL as the production source of relational truth and continue using claim_generation_jobs and billing_post_wallet_entry for cross-instance concurrency. Never replace them with process-local locks.
Keep one owner for external side effects and every write path. The Go implementation remains locally runnable and contract-tested but unrouted in production until a later explicit cutover.
Keep Alibaba Cloud OSS behind an object-storage Adapter and retain an explicit local-development Adapter; do not claim horizontal production safety until real OSS and RDS/TLS checks pass.
Preserve the currently deployed ACK-001 Web/HTTP-polling-Worker topology and all production Secrets/manifests during this implementation task.
Work only in the owned worktree and task record; canonical project memory is reserved for a serialized Integration Gate.

Completed in the feature worktree. Implemented and composed the remaining Go modules: administration and organization lifecycle, assets and hardened storage/remote fetch, billing ledger/catalog/settlement, usage reporting, jobs/providers/webhooks/worker loop, templates/prompt, settings/logging, public and compatibility HTTP routes, localstore adapters, PostgreSQL adapters, and lifecycle fencing migration 0002. Added language-neutral contracts and executable TypeScript/Go consumers while preserving the existing Next production ownership and deployment topology.
Added final lifecycle hardening for streamed HTTP event logging, unique worker lease tokens and CAS fencing, commit-outcome reconciliation, retry recovery handles, readiness checks for lifecycle columns, mock output registration, usage filter options, public webhook/priority validation, and a single settings/billing-account source.

CGO_ENABLED=0 go test -count=1 ./... — PASS
CGO_ENABLED=0 go test -race -count=1 ./internal/... (all migrated packages) — PASS
npm run go:vet — PASS
npm run go:build — PASS
npm test -- --run — 57 files / 172 tests PASS
npx tsc --noEmit --incremental false — PASS
npm run build — PASS (Next build)
node scripts/check-ack-manifests.mjs and npm run deploy:check — PASS
git diff --check, gofmt cleanliness, and production boundary diff checks — PASS
Independent sol_reviewer final review — PASS; no blocking findings.

Validate the complete backend against migrated non-production RDS with the real application role and verified-CA TLS before production cutover.
Validate OSS compatibility, provider credentials, external Webhooks, Worker drain/recovery, and rollout/rollback against production-like infrastructure.
Keep Go unrouted until the explicit production cutover review; do not delete the Next handlers or change Docker/ACK/Ingress ownership in this task.

Preserve the new Go module map and contract fixtures as candidates for the next serialized Integration Gate to promote into canonical architecture memory. This feature task does not modify shared canonical documents.