feat(auth): 新增密码登录注册与改密功能并加固安全

- 后端：新增密码登录/注册/重置/改密接口，users 表新增 password_hash 字段
- 安全加固：注册改为冲突即失败防止"注册即改密"，登录用户不存在统一返回密码错误并计失败次数防枚举，改密需校验旧密码，清理登录失败计数中的死代码
- 前端：登录页重构为"登录/注册"两个 tab，登录内可切换密码/短信方式，默认密码登录
- 个人中心新增修改密码入口（PC 弹窗 + 移动端 popup），PC 个人资料页移除买家/卖家服务面板

frontend/src/stores/session.ts

@@ -7,6 +7,7 @@ import {
   getRefreshToken,
   setAuthTokens,
 } from '@/shared/utils/authStorage'
+import { loginWithPassword, registerWithPassword } from '@/features/auth/api/auth'
 
 export const useSessionStore = defineStore('session', {
   state: () => ({
@@ -31,6 +32,16 @@ export const useSessionStore = defineStore('session', {
       this.applySession(result.user, result.tokens.access_token, result.tokens.refresh_token)
       return result
     },
+    async loginByPassword(phone: string, password: string) {
+      const result = await loginWithPassword(phone, password)
+      this.applySession(result.user, result.tokens.access_token, result.tokens.refresh_token)
+      return result
+    },
+    async register(phone: string, code: string, password: string) {
+      const result = await registerWithPassword(phone, code, password)
+      this.applySession(result.user, result.tokens.access_token, result.tokens.refresh_token)
+      return result
+    },
     async loadMe() {
       if (this._loadingMe) {
         // 如果正在加载，等待完成