feat(auth): 接入 DCAuth v2 登录并完善成员管理

- 登录链路改为用户名 + 密码 + 短信验证码 + DCAuth v2 设备签名
- 迁移 014：新增 login_sms_codes / user_devices / device_challenges 与 users.phone
- 新增 /api/dcauth/authorize 与 challenge 状态轮询；旧密码登录仅放行未绑定手机号的账号
- 成员管理支持手机号绑定、设备重置、账号改名、昵称与重置密码
- 移除最后一个商户关系时软删除账号，释放用户名、手机号并撤销设备绑定

backend/internal/handler/dcauth_test.go

@@ -0,0 +1,50 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"affiliate_dash/internal/service"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestDCAuthAuthorizeOldClientVersionReturns426(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	h := NewDCAuthHandler(service.NewDCAuthService(nil))
+	r := gin.New()
+	r.POST("/api/dcauth/authorize", h.Authorize)
+
+	body := `{
+		"app":"affiliate_dash",
+		"challengeId":"challenge-id",
+		"challenge":"challenge-value",
+		"deviceId":"D1-ABCDEFGH",
+		"publicKey":"YWJj",
+		"signature":"ZGVm",
+		"timestamp":` + strconv.FormatInt(time.Now().Unix(), 10) + `,
+		"clientVersion":"1.9.9"
+	}`
+	req := httptest.NewRequest("POST", "/api/dcauth/authorize", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	if w.Code != 426 {
+		t.Fatalf("expected 426, got %d: %s", w.Code, w.Body.String())
+	}
+	var payload struct {
+		Code    string `json:"code"`
+		Message string `json:"message"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("decode body: %v", err)
+	}
+	if payload.Code != "client_outdated" {
+		t.Fatalf("expected client_outdated, got %q", payload.Code)
+	}
+}