feat(auth): 接入 DCAuth v2 登录并完善成员管理

- 登录链路改为用户名 + 密码 + 短信验证码 + DCAuth v2 设备签名
- 迁移 014：新增 login_sms_codes / user_devices / device_challenges 与 users.phone
- 新增 /api/dcauth/authorize 与 challenge 状态轮询；旧密码登录仅放行未绑定手机号的账号
- 成员管理支持手机号绑定、设备重置、账号改名、昵称与重置密码
- 移除最后一个商户关系时软删除账号，释放用户名、手机号并撤销设备绑定

backend/internal/service/auth.go

@@ -15,10 +15,28 @@ type AuthService struct {
 	db     *gorm.DB
 	jwt    *jwt.Manager
 	tenant *TenantService
+	sms    *LoginSMSService
+	device *DCAuthService
 }
 
-func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService) *AuthService {
-	return &AuthService{db: db, jwt: jm, tenant: tenant}
+type AuthServiceOption func(*AuthService)
+
+// WithLoginSecurity 注入短信与设备认证依赖；未注入时仅保留旧密码登录。
+func WithLoginSecurity(sms *LoginSMSService, device *DCAuthService) AuthServiceOption {
+	return func(s *AuthService) {
+		s.sms = sms
+		s.device = device
+	}
+}
+
+func NewAuthService(db *gorm.DB, jm *jwt.Manager, tenant *TenantService, opts ...AuthServiceOption) *AuthService {
+	svc := &AuthService{db: db, jwt: jm, tenant: tenant}
+	for _, opt := range opts {
+		if opt != nil {
+			opt(svc)
+		}
+	}
+	return svc
 }
 
 type LoginResult struct {
@@ -34,24 +52,115 @@ type UpdateCurrentAccountInput struct {
 }
 
 func (s *AuthService) Login(username, password string) (*LoginResult, error) {
+	user, err := s.authenticatePassword(username, password)
+	if err != nil {
+		return nil, err
+	}
+	// 已绑定手机号的账号必须走安全登录，避免短信 + 设备绑定被旧入口绕过。
+	if strings.TrimSpace(user.Phone) != "" {
+		return nil, newAuthError(403, "device_auth_required", "该账号已启用安全登录，请使用账号密码 + 短信验证码 + 本机验证")
+	}
+	return s.issueLogin(user)
+}
+
+// authenticatePassword 统一处理账号状态与 bcrypt 校验。
+func (s *AuthService) authenticatePassword(username, password string) (*model.User, error) {
+	username = strings.TrimSpace(username)
+	if username == "" || password == "" {
+		return nil, newAuthError(400, "credentials_required", "请输入用户名和密码")
+	}
 	var user model.User
 	if err := s.db.Where("username = ?", username).First(&user).Error; err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, errors.New("用户名或密码错误")
+			return nil, newAuthError(401, "login_failed", "用户名或密码错误")
 		}
 		return nil, err
 	}
 	if user.Status != 1 {
-		return nil, errors.New("账号已禁用")
+		return nil, newAuthError(403, "account_disabled", "账号已禁用")
 	}
 	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
-		return nil, errors.New("用户名或密码错误")
+		return nil, newAuthError(401, "login_failed", "用户名或密码错误")
 	}
+	return &user, nil
+}
+
+func (s *AuthService) issueLogin(user *model.User) (*LoginResult, error) {
 	token, err := s.jwt.Generate(user.ID, user.Username, user.Role)
 	if err != nil {
 		return nil, err
 	}
-	return &LoginResult{Token: token, User: &user}, nil
+	return &LoginResult{Token: token, User: user}, nil
+}
+
+// SendLoginSMSCode 校验密码后向账号绑定手机号发送验证码。
+func (s *AuthService) SendLoginSMSCode(username, password, requestIP string) (*SendLoginCodeResult, error) {
+	if s.sms == nil {
+		return nil, newAuthError(503, "sms_unavailable", "短信服务未配置")
+	}
+	user, err := s.authenticatePassword(username, password)
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(user.Phone) == "" {
+		return nil, newAuthError(409, "phone_unbound", "该账号尚未绑定手机号，请联系管理员")
+	}
+	return s.sms.SendLoginCode(user, requestIP)
+}
+
+// PrepareLogin 校验密码与短信验证码后创建 DCAuth challenge。
+func (s *AuthService) PrepareLogin(username, password, smsCode, apiBase string) (*PreparedDeviceLogin, error) {
+	if s.sms == nil || s.device == nil {
+		return nil, newAuthError(503, "device_auth_unavailable", "安全登录服务未配置")
+	}
+	user, err := s.authenticatePassword(username, password)
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(user.Phone) == "" {
+		return nil, newAuthError(409, "phone_unbound", "该账号尚未绑定手机号，请联系管理员")
+	}
+	if err := s.sms.VerifyLoginCode(user.ID, smsCode); err != nil {
+		return nil, err
+	}
+	prepared, err := s.device.CreateChallenge(user.ID, apiBase)
+	if err != nil {
+		return nil, err
+	}
+	prepared.PhoneMasked = MaskPhone(user.Phone)
+	return prepared, nil
+}
+
+// CompleteLogin 消费一次性 ticket、校验设备绑定并复用现有 JWT 签发会话。
+func (s *AuthService) CompleteLogin(challengeID, pollToken, deviceTicket string) (*LoginResult, error) {
+	if s.device == nil {
+		return nil, newAuthError(503, "device_auth_unavailable", "安全登录服务未配置")
+	}
+	challenge, err := s.device.ConsumeTicket(challengeID, pollToken, deviceTicket)
+	if err != nil {
+		return nil, err
+	}
+	if challenge.App != DCAuthApp || challenge.Purpose != DCAuthPurposeLogin ||
+		challenge.DeviceID == "" || challenge.PublicKey == "" {
+		return nil, newAuthError(401, "ticket_invalid", "设备认证票据无效或已使用，请重新登录")
+	}
+	if challenge.UserID == nil {
+		return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
+	}
+	var user model.User
+	if err := s.db.First(&user, *challenge.UserID).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
+		}
+		return nil, err
+	}
+	if user.Status != 1 {
+		return nil, newAuthError(401, "auth_user_invalid", "登录账号已不可用，请重新登录")
+	}
+	if err := s.device.EnsureDeviceBinding(user.ID, challenge); err != nil {
+		return nil, err
+	}
+	return s.issueLogin(&user)
 }
 
 func (s *AuthService) GetProfile(userID uint) (*model.User, error) {