feat(auth): 接入 DCAuth v2 登录并完善成员管理

- 登录链路改为用户名 + 密码 + 短信验证码 + DCAuth v2 设备签名
- 迁移 014：新增 login_sms_codes / user_devices / device_challenges 与 users.phone
- 新增 /api/dcauth/authorize 与 challenge 状态轮询；旧密码登录仅放行未绑定手机号的账号
- 成员管理支持手机号绑定、设备重置、账号改名、昵称与重置密码
- 移除最后一个商户关系时软删除账号，释放用户名、手机号并撤销设备绑定

backend/internal/model/login_auth.go

@@ -0,0 +1,76 @@
+package model
+
+import "time"
+
+const (
+	LoginSMSPurposeLogin = "login"
+
+	DeviceChallengeStatusPending      = "pending"
+	DeviceChallengeStatusAuthorized   = "authorized"
+	DeviceChallengeStatusTicketIssued = "ticket_issued"
+	DeviceChallengeStatusConsumed     = "consumed"
+	DeviceChallengeStatusExpired      = "expired"
+	DeviceChallengeStatusRejected     = "rejected"
+
+	UserDeviceStatusActive  = "active"
+	UserDeviceStatusRevoked = "revoked"
+)
+
+// LoginSMSCode 登录短信验证码。验证码只保存 sha256 哈希，且一次性消费。
+type LoginSMSCode struct {
+	ID                 uint       `gorm:"primarykey" json:"id"`
+	UserID             uint       `gorm:"not null;index" json:"user_id"`
+	Phone              string     `gorm:"size:32;not null" json:"phone"`
+	Purpose            string     `gorm:"size:32;not null;default:login" json:"purpose"`
+	CodeHash           string     `gorm:"size:64;not null" json:"-"`
+	ExpiresAt          time.Time  `gorm:"not null" json:"expires_at"`
+	ConsumedAt         *time.Time `json:"consumed_at,omitempty"`
+	FailedAttemptCount int        `gorm:"not null;default:0" json:"failed_attempt_count"`
+	RequestIP          string     `gorm:"size:64;not null;default:''" json:"request_ip"`
+	CreatedAt          time.Time  `json:"created_at"`
+}
+
+func (LoginSMSCode) TableName() string { return "login_sms_codes" }
+
+// UserDevice DCAuth 设备绑定。每个用户同时只能有一台 active 设备。
+type UserDevice struct {
+	ID            uint       `gorm:"primarykey" json:"id"`
+	UserID        uint       `gorm:"not null;index" json:"user_id"`
+	DeviceID      string     `gorm:"size:128;not null;index" json:"device_id"`
+	PublicKey     string     `gorm:"size:128;not null" json:"public_key"`
+	ClientVersion string     `gorm:"size:64;not null;default:''" json:"client_version"`
+	Status        string     `gorm:"size:32;not null;default:active" json:"status"`
+	BoundAt       time.Time  `gorm:"not null" json:"bound_at"`
+	LastUsedAt    *time.Time `json:"last_used_at,omitempty"`
+	RevokedAt     *time.Time `json:"revoked_at,omitempty"`
+	RevokedBy     *uint      `json:"revoked_by,omitempty"`
+	CreatedAt     time.Time  `json:"created_at"`
+	UpdatedAt     time.Time  `json:"updated_at"`
+}
+
+func (UserDevice) TableName() string { return "user_devices" }
+
+// DeviceChallenge DCAuth 登录 challenge 与一次性 ticket 的状态机。
+// pending -> authorized -> ticket_issued -> consumed
+type DeviceChallenge struct {
+	ID               uint       `gorm:"primarykey" json:"id"`
+	ChallengeID      string     `gorm:"size:128;not null;uniqueIndex" json:"challenge_id"`
+	App              string     `gorm:"size:64;not null" json:"app"`
+	Purpose          string     `gorm:"size:32;not null;default:login" json:"purpose"`
+	Challenge        string     `gorm:"size:512;not null" json:"challenge"`
+	PollTokenHash    string     `gorm:"size:64;not null" json:"-"`
+	Status           string     `gorm:"size:32;not null;default:pending" json:"status"`
+	UserID           *uint      `json:"user_id,omitempty"`
+	DeviceID         string     `gorm:"size:128;not null;default:''" json:"device_id"`
+	PublicKey        string     `gorm:"size:128;not null;default:''" json:"public_key"`
+	ClientVersion    string     `gorm:"size:64;not null;default:''" json:"client_version"`
+	DeviceTicketHash string     `gorm:"size:64;not null;default:''" json:"-"`
+	ExpiresAt        time.Time  `gorm:"not null" json:"expires_at"`
+	AuthorizedAt     *time.Time `json:"authorized_at,omitempty"`
+	TicketIssuedAt   *time.Time `json:"ticket_issued_at,omitempty"`
+	ConsumedAt       *time.Time `json:"consumed_at,omitempty"`
+	CreatedAt        time.Time  `json:"created_at"`
+	UpdatedAt        time.Time  `json:"updated_at"`
+}
+
+func (DeviceChallenge) TableName() string { return "device_challenges" }

backend/internal/model/models.go

@@ -26,4 +26,15 @@ type User struct {
 	Nickname     string `gorm:"size:64" json:"nickname"`
 	Role         string `gorm:"size:32;not null;default:merchant" json:"role"`
 	Status       int    `gorm:"default:1" json:"status"` // 1启用 0禁用
+
+	// 登录安全：绑定手机号后强制走「密码 + 短信验证码 + DCAuth 设备签名」。
+	Phone        string     `gorm:"size:32;not null;default:''" json:"phone"`
+	PhoneBoundAt *time.Time `json:"phone_bound_at,omitempty"`
+	PhoneBoundBy *uint      `json:"phone_bound_by,omitempty"`
+
+	// 以下字段只用于管理端列表展示，不落库到 users 表。
+	PhoneMasked    string `gorm:"-" json:"phone_masked,omitempty"`
+	DeviceID       string `gorm:"-" json:"device_id,omitempty"`
+	DeviceIDMasked string `gorm:"-" json:"device_id_masked,omitempty"`
+	DeviceBound    bool   `gorm:"-" json:"device_bound"`
 }