feat(auth): 重构认证流程并补充前端登录态保护

- 拆分后端认证处理与会话创建逻辑，支持登录、注册、退出、个人资料和改密接口
- 增加二次验证挑战、Turnstile 人机校验与旧版邮箱迁移清理
- 新增前端认证守卫、管理员访问控制、退出 Hook 与验证工具
- 统一抽离接口类型，优化登录页、注册页和个人资料页的认证交互

apps/api/internal/app/two_factor.go

@@ -90,27 +90,6 @@ func generateTOTPForCounter(key []byte, counter int64) string {
 	return fmt.Sprintf("%06d", value%1000000)
 }
 
-func (a *App) issueSession(w http.ResponseWriter, r *http.Request, userID string) error {
-	token := randomToken()
-	sessionID := newID("ses")
-	expires := a.now().UTC().Add(time.Duration(a.cfg.SessionTTLHours) * time.Hour)
-	if _, err := a.db.ExecContext(r.Context(), `INSERT INTO sessions(id,user_id,token_hash,expires_at,created_at) VALUES(?,?,?,?,?)`,
-		sessionID, userID, hashToken(token), expires.Format(time.RFC3339Nano), a.now().UTC().Format(time.RFC3339Nano)); err != nil {
-		return err
-	}
-	http.SetCookie(w, &http.Cookie{
-		Name:     a.cfg.CookieName,
-		Value:    token,
-		Path:     "/",
-		Expires:  expires,
-		MaxAge:   int(time.Until(expires).Seconds()),
-		HttpOnly: true,
-		SameSite: http.SameSiteLaxMode,
-		Secure:   !a.cfg.AllowInsecureHTTP,
-	})
-	return nil
-}
-
 func (a *App) createLoginChallenge(ctx context.Context, userID string) (string, error) {
 	token := randomToken()
 	now := a.now().UTC()