feat(auth): 重构认证流程并补充前端登录态保护

- 拆分后端认证处理与会话创建逻辑，支持登录、注册、退出、个人资料和改密接口
- 增加二次验证挑战、Turnstile 人机校验与旧版邮箱迁移清理
- 新增前端认证守卫、管理员访问控制、退出 Hook 与验证工具
- 统一抽离接口类型，优化登录页、注册页和个人资料页的认证交互

apps/api/internal/app/session.go

@@ -0,0 +1,27 @@
+package app
+
+import (
+	"net/http"
+	"time"
+)
+
+func (a *App) issueSession(w http.ResponseWriter, r *http.Request, userID string) error {
+	token := randomToken()
+	sessionID := newID("ses")
+	expires := a.now().UTC().Add(time.Duration(a.cfg.SessionTTLHours) * time.Hour)
+	if _, err := a.db.ExecContext(r.Context(), `INSERT INTO sessions(id,user_id,token_hash,expires_at,created_at) VALUES(?,?,?,?,?)`,
+		sessionID, userID, hashToken(token), expires.Format(time.RFC3339Nano), a.now().UTC().Format(time.RFC3339Nano)); err != nil {
+		return err
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:     a.cfg.CookieName,
+		Value:    token,
+		Path:     "/",
+		Expires:  expires,
+		MaxAge:   int(time.Until(expires).Seconds()),
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		Secure:   !a.cfg.AllowInsecureHTTP,
+	})
+	return nil
+}