feat(dcauth): 移除机器码，改用纯设备码认证

- DCAuth 协议升级到 v2，签名原文只含设备码；客户端 2.0.0，旧版本返回 426
- 删除客户端机器码采集、后端 machine_code_* 字段与日志、后台机器码展示
- 102 迁移在生产执行前直接改为无机器码结构；SQL 守卫仅放行该文件
- Mock 短信不启用每日限额；修复慢电脑首次启动的协议转发竞态
- 新增 macOS DCAuth.app 打包脚本，注册 dcauth:// 协议，浏览器可直接唤起

apps/frontend/src/pages/admin/AdminLoginPage.tsx

@@ -241,17 +241,28 @@ export default function AdminLoginPage() {
                   <Alert
                     type="warning"
                     showIcon
-                    message="macOS 开发调试"
+                    message="macOS 未唤起 DCAuth"
                     description={
                       <Space direction="vertical" size={4} style={{ width: '100%' }}>
                         <Typography.Text type="secondary">
-                          浏览器无法直接唤起 Mac 程序。复制下面的链接，在终端执行：
+                          首次使用先安装一次，之后浏览器点登录即可直接唤起：
                         </Typography.Text>
-                        <Typography.Paragraph copyable={{ text: devLaunchUrl }} style={{ margin: 0 }}>
-                          {devLaunchUrl}
-                        </Typography.Paragraph>
-                        <Typography.Text code copyable={{ text: `cd apps/dcauth && go run . "${devLaunchUrl}"` }}>
-                          cd apps/dcauth && go run . "{devLaunchUrl}"
+                        <Typography.Text
+                          code
+                          copyable={{ text: 'cd apps/dcauth && ./build-macos.sh' }}
+                          style={{ wordBreak: 'break-all' }}
+                        >
+                          cd apps/dcauth && ./build-macos.sh
+                        </Typography.Text>
+                        <Typography.Text type="secondary">
+                          已安装但仍未弹出时，可在终端手动执行：
+                        </Typography.Text>
+                        <Typography.Text
+                          code
+                          copyable={{ text: `open "${devLaunchUrl}"` }}
+                          style={{ wordBreak: 'break-all' }}
+                        >
+                          open "{devLaunchUrl}"
                         </Typography.Text>
                       </Space>
                     }

apps/frontend/src/pages/admin/AdminUsersPage.tsx

@@ -455,7 +455,7 @@ export default function AdminUsersPage() {
       render: (_: boolean, row) =>
         row.deviceBound ? (
           <Space direction="vertical" size={0}>
-            <Typography.Text>{row.machineCodeMask || row.deviceIdMasked}</Typography.Text>
+            <Typography.Text>{row.deviceIdMasked}</Typography.Text>
             <Typography.Text type="secondary" style={{ fontSize: 12 }}>
               绑定于 {formatAdminDateTime(row.deviceBoundAt || '')}
             </Typography.Text>

apps/frontend/src/types/admin/auth.ts

@@ -35,7 +35,6 @@ export interface AdminDeviceStatusResponse {
   status: 'pending' | 'authorized' | 'ticket_issued' | 'consumed' | 'expired' | 'rejected'
   deviceTicket?: string
   deviceId?: string
-  machineCodeMask?: string
   message?: string
 }
 

apps/frontend/src/types/admin/users.ts

@@ -13,7 +13,6 @@ export interface AdminUserListItem {
   deviceBound: boolean
   deviceId: string
   deviceIdMasked: string
-  machineCodeMask: string
   deviceBoundAt: string | null
   deviceLastUsedAt: string | null
   createdAt: string