feat(auth): 接入 DCAuth v2 登录并完善成员管理

- 登录链路改为用户名 + 密码 + 短信验证码 + DCAuth v2 设备签名
- 迁移 014：新增 login_sms_codes / user_devices / device_challenges 与 users.phone
- 新增 /api/dcauth/authorize 与 challenge 状态轮询；旧密码登录仅放行未绑定手机号的账号
- 成员管理支持手机号绑定、设备重置、账号改名、昵称与重置密码
- 移除最后一个商户关系时软删除账号，释放用户名、手机号并撤销设备绑定

backend/internal/handler/auth.go

@@ -29,12 +29,85 @@ func (h *AuthHandler) Login(c *gin.Context) {
 	}
 	result, err := h.svc.Login(req.Username, req.Password)
 	if err != nil {
-		response.BadRequest(c, err.Error())
+		writeServiceError(c, err, "用户名或密码错误")
 		return
 	}
 	response.OK(c, result)
 }
 
+type sendSMSCodeReq struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+func (h *AuthHandler) SendLoginSMSCode(c *gin.Context) {
+	var req sendSMSCodeReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请输入用户名和密码")
+		return
+	}
+	result, err := h.svc.SendLoginSMSCode(req.Username, req.Password, c.ClientIP())
+	if err != nil {
+		writeServiceError(c, err, "验证码发送失败")
+		return
+	}
+	response.OK(c, result)
+}
+
+type prepareLoginReq struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+	SMSCode  string `json:"smsCode" binding:"required"`
+	APIBase  string `json:"apiBase"`
+}
+
+func (h *AuthHandler) PrepareLogin(c *gin.Context) {
+	var req prepareLoginReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "请填写用户名、密码和短信验证码")
+		return
+	}
+	apiBase := req.APIBase
+	if apiBase == "" {
+		apiBase = c.GetHeader("Origin")
+	}
+	prepared, err := h.svc.PrepareLogin(req.Username, req.Password, req.SMSCode, apiBase)
+	if err != nil {
+		writeServiceError(c, err, "安全登录准备失败")
+		return
+	}
+	response.OK(c, prepared)
+}
+
+type completeLoginReq struct {
+	ChallengeID  string `json:"challengeId" binding:"required"`
+	PollToken    string `json:"pollToken" binding:"required"`
+	DeviceTicket string `json:"deviceTicket" binding:"required"`
+}
+
+func (h *AuthHandler) CompleteLogin(c *gin.Context) {
+	var req completeLoginReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "缺少设备认证票据")
+		return
+	}
+	result, err := h.svc.CompleteLogin(req.ChallengeID, req.PollToken, req.DeviceTicket)
+	if err != nil {
+		writeServiceError(c, err, "安全登录失败")
+		return
+	}
+	response.OK(c, result)
+}
+
+// writeServiceError 保留 AuthError 的 HTTP 状态码；其他错误统一 400。
+func writeServiceError(c *gin.Context, err error, fallback string) {
+	if authErr, ok := service.AsAuthError(err); ok {
+		response.Fail(c, authErr.Status, authErr.Status, authErr.Message)
+		return
+	}
+	response.BadRequest(c, err.Error())
+}
+
 func (h *AuthHandler) Profile(c *gin.Context) {
 	user, err := h.svc.GetProfile(middleware.GetUserID(c))
 	if err != nil {