feat: support MFA status filter for users

[huanghongbo-hhb]

Summary

• Add MFA status filtering to user search and simplify role-filtered user queries.

Why

• User management needs MFA filtering without regressing list and account-search behavior.

Main Changes

• Add optional mfa_enabled to user search, OpenAPI query, and shared client args/response.
• Query mfa_enabled directly from user_mfa and apply the same filter to list, count, and account lookup.
• Batch-load system roles for the current page and simplify role-filtered queries with a role-uid subquery.

Risk / Compatibility

• Backward compatible: omitting mfa_enabled keeps existing behavior.
• Low risk: schema unchanged; queries reuse existing user_mfa.uid and role relations.

Test

• GOCACHE=/private/tmp/go-build-cache go test ./pkg/microservice/user/core/repository/orm
• GOCACHE=/private/tmp/go-build-cache go test ./pkg/microservice/user/core/service/permission
• GOCACHE=/private/tmp/go-build-cache go test ./pkg/microservice/user/core/handler/user

Contact

Contact: huanghongbo@koderover.com

---

This change is 

[PetrusZ]

你有看过这句生成的SQL吗？感觉很复杂，把实际SQL打印出来看看吧

[huanghongbo-hhb]

-- ListUsersByNameAndRoleWithLoginTime, mfa_enabled = true
SELECT user.uid, user.name, user.account, user.identity_type, user.api_token_enabled,
IFNULL(user_mfa.enabled, 0) AS mfa_enabled,
IFNULL(user_login.last_login_time, 0) AS last_login_time
FROM user
LEFT JOIN user_login ON user_login.uid = user.uid
LEFT JOIN user_mfa ON user_mfa.uid = user.uid
WHERE user.uid IN (
SELECT DISTINCT role_binding.uid
FROM role_binding
INNER JOIN role ON role.id = role_binding.role_id
WHERE role.name IN (?,?) AND role.namespace = ?
)
AND user.name LIKE ?
AND user_mfa.enabled = ?
ORDER BY last_login_time DESC
LIMIT ?;

-- ListUsersByNameAndRole, mfa_enabled = true
SELECT user.*, IFNULL(user_mfa.enabled, 0) AS mfa_enabled
FROM user
LEFT JOIN user_mfa ON user_mfa.uid = user.uid
WHERE user.uid IN (
SELECT DISTINCT role_binding.uid
FROM role_binding
INNER JOIN role ON role.id = role_binding.role_id
WHERE role.name IN (?,?) AND role.namespace = ?
)
AND user.name LIKE ?
AND user_mfa.enabled = ?
ORDER BY account ASC
LIMIT ?;

-- ListUsersByNameAndRole, mfa_enabled = true
SELECT user.*, IFNULL(user_mfa.enabled, 0) AS mfa_enabled
FROM user
LEFT JOIN user_mfa ON user_mfa.uid = user.uid
WHERE user.uid IN (
SELECT DISTINCT role_binding.uid
FROM role_binding
INNER JOIN role ON role.id = role_binding.role_id
WHERE role.name IN (?,?) AND role.namespace = ?
)
AND user.name LIKE ?
AND user_mfa.enabled = ?
ORDER BY account ASC
LIMIT ?;
其实我觉得还好？