backend: add bookmark CRUD with public list endpoint

New bookmarks feature: domain model, repository, service and handler
supporting list/create/update/delete. Public endpoint exposes the
admin user's bookmarks for the homepage navigation grid; authenticated
endpoints scope by user. Dev Dockerfile drops air for plain `go run`
and uses goproxy.cn to avoid build failures on the deploy host.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/repository/user.go

@@ -41,6 +41,12 @@ func (r *UserRepository) FindByKeycloakID(keycloakID string) (*domain.User, erro
 	return &user, err
 }
 
+func (r *UserRepository) FindByRole(role string) (*domain.User, error) {
+	var user domain.User
+	err := r.db.Where("role = ?", role).First(&user).Error
+	return &user, err
+}
+
 func (r *UserRepository) ListAll() ([]domain.User, error) {
 	var users []domain.User
 	err := r.db.Select("id", "username", "email", "role", "keycloak_id", "created_at", "updated_at").Find(&users).Error