feat(auth): 新增密码登录注册与改密功能并加固安全

- 后端：新增密码登录/注册/重置/改密接口，users 表新增 password_hash 字段
- 安全加固：注册改为冲突即失败防止"注册即改密"，登录用户不存在统一返回密码错误并计失败次数防枚举，改密需校验旧密码，清理登录失败计数中的死代码
- 前端：登录页重构为"登录/注册"两个 tab，登录内可切换密码/短信方式，默认密码登录
- 个人中心新增修改密码入口（PC 弹窗 + 移动端 popup），PC 个人资料页移除买家/卖家服务面板

backend/internal/modules/auth/handler.go

@@ -29,6 +29,28 @@ type RefreshRequest struct {
 	RefreshToken string `json:"refresh_token" binding:"required"`
 }
 
+type PasswordLoginRequest struct {
+	Phone    string `json:"phone" binding:"required"`
+	Password string `json:"password" binding:"required,min=8,max=20"`
+}
+
+type SetPasswordRequest struct {
+	Password    string `json:"password" binding:"required,min=8,max=20"`
+	OldPassword string `json:"old_password"`
+}
+
+type RegisterRequest struct {
+	Phone    string `json:"phone" binding:"required"`
+	Code     string `json:"code" binding:"required,len=6"`
+	Password string `json:"password" binding:"required,min=8,max=20"`
+}
+
+type ResetPasswordRequest struct {
+	Phone       string `json:"phone" binding:"required"`
+	Code        string `json:"code" binding:"required,len=6"`
+	NewPassword string `json:"new_password" binding:"required,min=8,max=20"`
+}
+
 func NewHandler(service *Service) *Handler {
 	return &Handler{service: service}
 }
@@ -130,6 +152,65 @@ func (h *Handler) Logout(c *gin.Context) {
 	response.OK(c, gin.H{"logged_out": true})
 }
 
+func (h *Handler) PasswordLogin(c *gin.Context) {
+	var req PasswordLoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "手机号和密码不能为空，密码长度 8-20 位")
+		return
+	}
+	result, err := h.service.LoginWithPassword(c.Request.Context(), strings.TrimSpace(req.Phone), req.Password, c.ClientIP())
+	if err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) Register(c *gin.Context) {
+	var req RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "手机号、验证码和密码不能为空，密码长度 8-20 位")
+		return
+	}
+	result, err := h.service.RegisterWithPassword(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.Code), req.Password)
+	if err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, result)
+}
+
+func (h *Handler) SetPassword(c *gin.Context) {
+	var req SetPasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "密码不能为空，长度 8-20 位")
+		return
+	}
+	userID, ok := currentUserID(c)
+	if !ok {
+		response.Unauthorized(c, "缺少用户上下文")
+		return
+	}
+	if err := h.service.SetPassword(c.Request.Context(), userID, req.Password, req.OldPassword); err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"updated": true})
+}
+
+func (h *Handler) ResetPassword(c *gin.Context) {
+	var req ResetPasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "手机号、验证码和新密码不能为空")
+		return
+	}
+	if err := h.service.ResetPassword(c.Request.Context(), strings.TrimSpace(req.Phone), strings.TrimSpace(req.Code), req.NewPassword); err != nil {
+		writeAuthError(c, err)
+		return
+	}
+	response.OK(c, gin.H{"reseted": true})
+}
+
 func writeAuthError(c *gin.Context, err error) {
 	switch {
 	case errors.Is(err, ErrDependencyUnavailable):
@@ -146,7 +227,28 @@ func writeAuthError(c *gin.Context, err error) {
 		response.BadRequest(c, "验证码错误或已过期")
 	case errors.Is(err, ErrUserDisabled):
 		response.Error(c, http.StatusForbidden, "user_disabled", "用户已被冻结")
+	case errors.Is(err, ErrInvalidPassword):
+		response.BadRequest(c, "手机号或密码错误")
+	case errors.Is(err, ErrInvalidOldPassword):
+		response.BadRequest(c, "原密码错误")
+	case errors.Is(err, ErrPasswordNotSet):
+		response.BadRequest(c, "未设置密码，请使用短信验证码登录后设置密码")
+	case errors.Is(err, ErrPasswordTooWeak):
+		response.BadRequest(c, "密码长度应为 8-20 位")
+	case errors.Is(err, ErrLoginLocked):
+		response.Error(c, http.StatusTooManyRequests, "login_locked", "登录失败次数过多，请 15 分钟后再试")
+	case errors.Is(err, ErrUserAlreadyExists):
+		response.BadRequest(c, "该手机号已注册，请直接登录或使用短信验证码登录")
 	default:
 		response.Error(c, http.StatusInternalServerError, "internal_error", "服务暂时不可用")
 	}
 }
+
+func currentUserID(c *gin.Context) (uint64, bool) {
+	val, exists := c.Get("user_id")
+	if !exists {
+		return 0, false
+	}
+	userID, ok := val.(uint64)
+	return userID, ok
+}