feat(auth): 接入 DCAuth v2 登录并完善成员管理

- 登录链路改为用户名 + 密码 + 短信验证码 + DCAuth v2 设备签名
- 迁移 014：新增 login_sms_codes / user_devices / device_challenges 与 users.phone
- 新增 /api/dcauth/authorize 与 challenge 状态轮询；旧密码登录仅放行未绑定手机号的账号
- 成员管理支持手机号绑定、设备重置、账号改名、昵称与重置密码
- 移除最后一个商户关系时软删除账号，释放用户名、手机号并撤销设备绑定

backend/cmd/server/main.go

@@ -79,7 +79,18 @@ func main() {
 		log.Fatalf("setup secret codec: %v", err)
 	}
 	tenantSvc := service.NewTenantService(db)
-	authSvc := service.NewAuthService(db, jm, tenantSvc)
+	smsSvc := service.NewLoginSMSService(db, service.SMSConfig{
+		Provider:        cfg.SMSProvider,
+		AccessKeyID:     cfg.SMSAccessKeyID,
+		AccessKeySecret: cfg.SMSAccessKeySecret,
+		SignName:        cfg.SMSSignName,
+		TemplateCode:    cfg.SMSTemplateCode,
+		CodeTTLSeconds:  cfg.SMSCodeTTLSeconds,
+		CooldownSeconds: cfg.SMSCooldownSeconds,
+		DailyLimit:      cfg.SMSDailyLimit,
+	})
+	deviceSvc := service.NewDCAuthService(db)
+	authSvc := service.NewAuthService(db, jm, tenantSvc, service.WithLoginSecurity(smsSvc, deviceSvc))
 	userSvc := service.NewUserService(db, tenantSvc)
 	callbackSvc := service.NewCallbackService(db, codec, service.WithCallbackConfig(service.CallbackConfig{
 		MaxAttempts:   cfg.CallbackMaxAttempts,
@@ -127,6 +138,7 @@ func main() {
 
 	h := &router.Handlers{
 		Auth:               handler.NewAuthHandler(authSvc),
+		DCAuth:             handler.NewDCAuthHandler(deviceSvc),
 		Dashboard:          handler.NewDashboardHandler(fulfillmentSvc),
 		Delivery:           handler.NewDeliveryHandler(deliverySvc),
 		User:               handler.NewUserHandler(userSvc),
@@ -176,6 +188,7 @@ func main() {
 	if cfg.LogFile != "" {
 		applog.Infof("日志文件: %s （同时输出控制台）", cfg.LogFile)
 	}
+	applog.Infof("登录短信渠道: %s", cfg.SMSProvider)
 	if err := r.Run(addr); err != nil {
 		log.Fatalf("server: %v", err)
 	}