feat(dcauth): 移除机器码，改用纯设备码认证

- DCAuth 协议升级到 v2，签名原文只含设备码；客户端 2.0.0，旧版本返回 426
- 删除客户端机器码采集、后端 machine_code_* 字段与日志、后台机器码展示
- 102 迁移在生产执行前直接改为无机器码结构；SQL 守卫仅放行该文件
- Mock 短信不启用每日限额；修复慢电脑首次启动的协议转发竞态
- 新增 macOS DCAuth.app 打包脚本，注册 dcauth:// 协议，浏览器可直接唤起

apps/dcauth/main_test.go

@@ -1,6 +1,9 @@
 package main
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestParseAuthorizeURLAllowedOrigins(t *testing.T) {
 	tests := []struct {
@@ -33,3 +36,20 @@ func TestParseAuthorizeURLRejectsUnknownOrigin(t *testing.T) {
 		t.Fatal("parseAuthorizeURL() accepted an unknown origin")
 	}
 }
+
+func TestBuildAuthorizationCanonicalUsesDeviceCodeOnly(t *testing.T) {
+	id := identity{deviceID: "D1-ABCD-EFGH-JKLM-NPQR"}
+	target := authorizeTarget{
+		App:         "order_site",
+		ChallengeID: "challenge-id",
+		Challenge:   "challenge-value",
+	}
+	got := buildAuthorizationCanonical(id, target, 1700000000)
+	want := "dcauth.v2\norder_site\nchallenge-id\nchallenge-value\nD1-ABCD-EFGH-JKLM-NPQR\n1700000000"
+	if got != want {
+		t.Fatalf("canonical = %q, want %q", got, want)
+	}
+	if strings.Contains(got, "M1-") || strings.Contains(strings.ToLower(got), "machine") {
+		t.Fatalf("canonical still contains machine code data: %q", got)
+	}
+}