登录子系统：OIDC 统一自签 token + 吊销即时生效 + 设备并入会话列表 + 应用内扫码 + 禁则修复

接续 90a3790（扫码 A0+A1+B + step-up 雏形）。蓝本见 AUTH.md。

OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名（自签 token 的唯一信任锚）再签 cdrop
  自签 HS256 access token（绑 sid），不再把 IdP RS256 下发浏览器；验签失败仅告警
  并回退 RS256（会话仍建、下次 refresh 自愈），登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销，但同样回
  自签 token；createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback（其即时吊销留后续）

吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行，行删即拒 → 吊销在被吊销设备
  下一次请求即生效（不等 TTL），oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页；短期连接
  失败（5xx / 网络）一律保留登录态（refreshTokens 改三态 refreshed/invalid/transient，
  cookieRefresh 改 discriminated 结果）
- __root 反应式守卫：prod 下失登录态且非认证路由即跳登录页；新增 auth.sessionLost.* 三语

设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备（桌面 / iOS，自 devices
  登记表呈现，native=true，离线也列）；同名不重复列出，排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记（无同名在用会话时）；原生「登出」走
  DELETE /api/devices/{name}（同要求 step-up）
- 新增 DeleteOrphanBrowserDevices（browser 型且无存活 web_session），接入设备清扫器（1h）

应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码，不再外跳系统应用（避免开错浏览器）
- 修聚珍（cjk-autospace）MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
  崩溃：扫码 / 显码 / 批准三状态机页整页跳过聚珍（data-jz-skip）
- 修流动正文未跑 CJK 禁则（jinze 为段落级、须 opt-in）：设置 / 快捷指令 / 桌面页一批
  hint 补 data-jz-level="paragraph" + justify，短标签 / 状态仍留文本级

step-up 完善
- auth_time 改可选（Casdoor 不下发，原强制致死循环）；stepped_up_at 按会话绑定、
  StepUpMaxAgeSeconds 窗口内不复要求；新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失；scope 随档绑定（信任=full /
  仅此次=guest），默认偏安全的「仅此次」

文档与测试
- AUTH.md：折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试：OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
  统一会话列表（含原生 / 不含 shortcut / 不重复）、孤儿清扫、删设备需 step-up

internal/db/bootstrap.go

@@ -74,6 +74,10 @@ func Bootstrap(ctx context.Context, d *sql.DB) error {
 		"ALTER TABLE web_sessions ADD COLUMN granted_by TEXT NOT NULL DEFAULT ''"); err != nil {
 		return fmt.Errorf("migrate web_sessions.granted_by: %w", err)
 	}
+	if err := ensureColumn(ctx, tx, "web_sessions", "stepped_up_at",
+		"ALTER TABLE web_sessions ADD COLUMN stepped_up_at INTEGER NOT NULL DEFAULT 0"); err != nil {
+		return fmt.Errorf("migrate web_sessions.stepped_up_at: %w", err)
+	}
 	if err := tx.Commit(); err != nil {
 		return fmt.Errorf("commit bootstrap: %w", err)
 	}

internal/db/devices.sql.go

@@ -27,6 +27,29 @@ func (q *Queries) DeleteDevice(ctx context.Context, arg DeleteDeviceParams) (int
 	return result.RowsAffected()
 }
 
+const deleteOrphanBrowserDevices = `-- name: DeleteOrphanBrowserDevices :execrows
+DELETE FROM devices
+WHERE type = 'browser'
+  AND NOT EXISTS (
+    SELECT 1 FROM web_sessions ws
+    WHERE ws.user_id = devices.user_id
+      AND ws.device_name = devices.name
+      AND ws.expires_at > ?
+  )
+`
+
+// DeleteOrphanBrowserDevices removes browser device rows with no live web_session
+// (the session was revoked or expired), keeping the device list aligned with the
+// session list. The ? is the current epoch second. Native (macos/windows/linux/ios)
+// and shortcut devices are left alone: they legitimately keep no web_session.
+func (q *Queries) DeleteOrphanBrowserDevices(ctx context.Context, expiresAt int64) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteOrphanBrowserDevices, expiresAt)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const deleteStaleDevices = `-- name: DeleteStaleDevices :exec
 DELETE FROM devices
 WHERE last_seen < ?

internal/db/migrations/0001_init.sql

@@ -73,7 +73,10 @@ CREATE TABLE IF NOT EXISTS web_sessions (
     -- 但不能改账号、不能再批准别的设备、不能签发长效 token（路由层 requireFullSession 守门）。
     scope         TEXT NOT NULL DEFAULT 'full',
     -- granted_by＝扫码批准者的 session id，供审计与「吊销我批准过的借用设备」连带吊销。
-    granted_by    TEXT NOT NULL DEFAULT ''
+    granted_by    TEXT NOT NULL DEFAULT '',
+    -- stepped_up_at＝本会话最近一次通过 step-up 再认证的 Unix 秒（AUTH.md §6）。在
+    -- StepUpMaxAgeSeconds 窗口内，敏感动作不再重复要求再认证（避免每次都弹再登录）。
+    stepped_up_at INTEGER NOT NULL DEFAULT 0
 );
 
 CREATE INDEX IF NOT EXISTS idx_web_sessions_expires ON web_sessions (expires_at);

internal/db/models.go

@@ -101,4 +101,5 @@ type WebSession struct {
 	Kind         string `json:"kind"`
 	Scope        string `json:"scope"`
 	GrantedBy    string `json:"granted_by"`
+	SteppedUpAt  int64  `json:"stepped_up_at"`
 }

internal/db/queries/devices.sql

@@ -15,6 +15,20 @@ ORDER BY name;
 DELETE FROM devices
 WHERE last_seen < ?;
 
+-- DeleteOrphanBrowserDevices removes browser device rows with no live web_session
+-- (the session was revoked or expired), keeping the device list aligned with the
+-- session list. The ? is the current epoch second. Native (macos/windows/linux/ios)
+-- and shortcut devices are left alone: they legitimately keep no web_session.
+-- name: DeleteOrphanBrowserDevices :execrows
+DELETE FROM devices
+WHERE type = 'browser'
+  AND NOT EXISTS (
+    SELECT 1 FROM web_sessions ws
+    WHERE ws.user_id = devices.user_id
+      AND ws.device_name = devices.name
+      AND ws.expires_at > ?
+  );
+
 -- name: DeleteDevice :execrows
 DELETE FROM devices
 WHERE user_id = ? AND name = ?;

internal/db/queries/web_sessions.sql

@@ -9,10 +9,17 @@ INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, c
 VALUES (?, ?, ?, ?, ?, ?, ?, ?);
 
 -- name: GetWebSession :one
-SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
+SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by, stepped_up_at
 FROM web_sessions
 WHERE id = ?;
 
+-- SetSessionSteppedUp stamps the moment this session last passed step-up re-auth;
+-- sensitive actions within the freshness window then skip re-auth (AUTH.md 6).
+-- name: SetSessionSteppedUp :exec
+UPDATE web_sessions
+SET stepped_up_at = ?
+WHERE id = ?;
+
 -- name: RotateWebSession :exec
 UPDATE web_sessions
 SET refresh_token = ?, last_used_at = ?, expires_at = ?

internal/db/web_sessions.sql.go

@@ -126,7 +126,7 @@ func (q *Queries) DeleteWebSessionForUser(ctx context.Context, arg DeleteWebSess
 }
 
 const getWebSession = `-- name: GetWebSession :one
-SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
+SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by, stepped_up_at
 FROM web_sessions
 WHERE id = ?
 `
@@ -146,6 +146,7 @@ func (q *Queries) GetWebSession(ctx context.Context, id string) (WebSession, err
 		&i.Kind,
 		&i.Scope,
 		&i.GrantedBy,
+		&i.SteppedUpAt,
 	)
 	return i, err
 }
@@ -230,6 +231,24 @@ func (q *Queries) RotateWebSession(ctx context.Context, arg RotateWebSessionPara
 	return err
 }
 
+const setSessionSteppedUp = `-- name: SetSessionSteppedUp :exec
+UPDATE web_sessions
+SET stepped_up_at = ?
+WHERE id = ?
+`
+
+type SetSessionSteppedUpParams struct {
+	SteppedUpAt int64  `json:"stepped_up_at"`
+	ID          string `json:"id"`
+}
+
+// SetSessionSteppedUp stamps the moment this session last passed step-up re-auth;
+// sensitive actions within the freshness window then skip re-auth (AUTH.md 6).
+func (q *Queries) SetSessionSteppedUp(ctx context.Context, arg SetSessionSteppedUpParams) error {
+	_, err := q.db.ExecContext(ctx, setSessionSteppedUp, arg.SteppedUpAt, arg.ID)
+	return err
+}
+
 const setWebSessionDevice = `-- name: SetWebSessionDevice :exec
 UPDATE web_sessions
 SET device_name = ?