backend: add bookmark CRUD with public list endpoint

New bookmarks feature: domain model, repository, service and handler
supporting list/create/update/delete. Public endpoint exposes the
admin user's bookmarks for the homepage navigation grid; authenticated
endpoints scope by user. Dev Dockerfile drops air for plain `go run`
and uses goproxy.cn to avoid build failures on the deploy host.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/internal/service/user.go

@@ -93,6 +93,10 @@ func (s *UserService) BindKeycloak(username, password, keycloakID, keycloakEmail
 	return user, nil
 }
 
+func (s *UserService) FindByRole(role string) (*domain.User, error) {
+	return s.repo.FindByRole(role)
+}
+
 func (s *UserService) ListUsers() ([]domain.User, error) {
 	return s.repo.ListAll()
 }