登录子系统：OIDC 统一自签 token + 吊销即时生效 + 设备并入会话列表 + 应用内扫码 + 禁则修复

接续 90a3790（扫码 A0+A1+B + step-up 雏形）。蓝本见 AUTH.md。

OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名（自签 token 的唯一信任锚）再签 cdrop
  自签 HS256 access token（绑 sid），不再把 IdP RS256 下发浏览器；验签失败仅告警
  并回退 RS256（会话仍建、下次 refresh 自愈），登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销，但同样回
  自签 token；createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback（其即时吊销留后续）

吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行，行删即拒 → 吊销在被吊销设备
  下一次请求即生效（不等 TTL），oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页；短期连接
  失败（5xx / 网络）一律保留登录态（refreshTokens 改三态 refreshed/invalid/transient，
  cookieRefresh 改 discriminated 结果）
- __root 反应式守卫：prod 下失登录态且非认证路由即跳登录页；新增 auth.sessionLost.* 三语

设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备（桌面 / iOS，自 devices
  登记表呈现，native=true，离线也列）；同名不重复列出，排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记（无同名在用会话时）；原生「登出」走
  DELETE /api/devices/{name}（同要求 step-up）
- 新增 DeleteOrphanBrowserDevices（browser 型且无存活 web_session），接入设备清扫器（1h）

应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码，不再外跳系统应用（避免开错浏览器）
- 修聚珍（cjk-autospace）MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
  崩溃：扫码 / 显码 / 批准三状态机页整页跳过聚珍（data-jz-skip）
- 修流动正文未跑 CJK 禁则（jinze 为段落级、须 opt-in）：设置 / 快捷指令 / 桌面页一批
  hint 补 data-jz-level="paragraph" + justify，短标签 / 状态仍留文本级

step-up 完善
- auth_time 改可选（Casdoor 不下发，原强制致死循环）；stepped_up_at 按会话绑定、
  StepUpMaxAgeSeconds 窗口内不复要求；新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失；scope 随档绑定（信任=full /
  仅此次=guest），默认偏安全的「仅此次」

文档与测试
- AUTH.md：折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试：OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
  统一会话列表（含原生 / 不含 shortcut / 不重复）、孤儿清扫、删设备需 step-up

internal/httpapi/auth.go

@@ -19,7 +19,9 @@ import (
 
 // PROJECT_BRIEF.md §2 keeps the browser path on standard OIDC PKCE. Backend
 // proxies the token endpoint so the browser doesn't need a CORS-friendly OIDC
-// provider; the access_token still flows back to the browser unchanged.
+// provider. The browser is then handed a cdrop self-signed access token (sid-bound
+// to its web_sessions row), not the IdP's RS256 token, so OIDC web sessions verify
+// statefully and revoke immediately — unified with scan-login (AUTH.md §5).
 
 type authConfigResp struct {
 	AuthMode     string `json:"auth_mode"`
@@ -120,33 +122,58 @@ func (s *Server) handleAuthExchange(w http.ResponseWriter, r *http.Request) {
 	// Refresh the thin accounts row (display name / avatar / roles / match_key).
 	s.upsertAccount(r.Context(), identity)
 
-	// Stash the refresh_token server-side and hand the browser an opaque,
-	// HttpOnly cookie instead. Guarded so a deploy without the encryption key (or
-	// an IdP that returned no refresh_token) still logs the user in — they just
-	// don't get passwordless re-login and re-auth on the next access-token expiry.
+	// By default the browser holds a cdrop self-signed access token (sid-bound),
+	// not the IdP's RS256 token — so the OIDC web session is verified statefully on
+	// every request (verifySelfToken → web_sessions lookup) and revoking the row
+	// logs this device out on its very next call, exactly like scan-login. We mint
+	// it only after stashing the refresh_token server-side (encrypted, behind an
+	// HttpOnly cookie) so the session is durable. The IdP RS256 token stays the
+	// fallback for degraded configs (no encryption key / no refresh_token / an
+	// id_token that fails verification) — it is still independently verified per
+	// request via JWKS (verifyRS256), and the next refresh upgrades the device to
+	// the unified self-token model. (AUTH.md §5; desktop keeps its RS256 token.)
+	accessToken, expiresIn := tr.AccessToken, tr.ExpiresIn
 	if len(s.sessionKey) > 0 && tr.RefreshToken != "" {
-		if err := s.createWebSession(r, w, user.ID, tr.RefreshToken); err != nil {
-			slog.Error("create web session failed", "err", err)
+		id, cerr := s.createWebSession(r, w, user.ID, tr.RefreshToken)
+		if cerr != nil {
+			slog.Error("create web session failed", "err", cerr)
+		} else {
+			// The id_token is the SOLE trust anchor for the minted self token (the
+			// IdP RS256 token no longer reaches the browser to be re-verified), so
+			// its signature MUST validate here and its subject must match. On
+			// failure we keep the durable session but hand back the per-request-
+			// verified RS256 token; the next refresh upgrades this device to the
+			// self-token model. (Should not happen with a healthy IdP — warn ops.)
+			sub, _, verr := s.auth.VerifyIDToken(r.Context(), tr.IDToken)
+			if verr != nil || sub != user.ID {
+				slog.Warn("oidc id_token verification failed; using RS256 fallback",
+					"err", verr, "sub_match", sub == user.ID)
+			} else if tok, ein, merr := s.mintSessionToken(user.ID, id, "full"); merr != nil {
+				slog.Error("mint session token failed", "err", merr)
+			} else {
+				accessToken, expiresIn = tok, ein
+			}
 		}
 	}
 
 	writeJSON(w, http.StatusOK, exchangeResp{
-		AccessToken: tr.AccessToken,
-		ExpiresIn:   tr.ExpiresIn,
+		AccessToken: accessToken,
+		ExpiresIn:   expiresIn,
 		User:        user,
 	})
 }
 
 // createWebSession encrypts the refresh_token, persists a new session row, and
-// sets the session cookie on the response.
-func (s *Server) createWebSession(r *http.Request, w http.ResponseWriter, userID, refreshToken string) error {
+// sets the session cookie on the response. Returns the session row id so the
+// caller can bind a cdrop self-signed access token to it (sid).
+func (s *Server) createWebSession(r *http.Request, w http.ResponseWriter, userID, refreshToken string) (string, error) {
 	raw, id, err := newSessionToken()
 	if err != nil {
-		return err
+		return "", err
 	}
 	enc, err := s.encryptRefresh(refreshToken)
 	if err != nil {
-		return err
+		return "", err
 	}
 	now := time.Now()
 	if err := s.queries.CreateWebSession(r.Context(), db.CreateWebSessionParams{
@@ -159,10 +186,10 @@ func (s *Server) createWebSession(r *http.Request, w http.ResponseWriter, userID
 		LastUsedAt:   now.Unix(),
 		ExpiresAt:    now.Add(webSessionTTL).Unix(),
 	}); err != nil {
-		return err
+		return "", err
 	}
 	setSessionCookie(w, raw)
-	return nil
+	return id, nil
 }
 
 // refreshResp is what the browser sees: a fresh access_token plus the identity
@@ -282,9 +309,23 @@ func (s *Server) handleAuthRefresh(w http.ResponseWriter, r *http.Request) {
 	}
 	setSessionCookie(w, c.Value)
 
+	// Hand back a cdrop self-signed access token (sid-bound), not the IdP RS256
+	// token: the browser holds one uniform token type and revoking the session row
+	// logs this device out on its next request. The IdP round-trip above still ran
+	// — it rotated the refresh_token and surfaced IdP-side revocation (a rejected
+	// refresh deletes the session above) — its access_token simply no longer ships.
+	// Mint from the row's canonical user_id; degrade to the IdP token only if the
+	// HS256 key is unconfigured. (AUTH.md §5.)
+	accessToken, expiresIn := tr.AccessToken, tr.ExpiresIn
+	if tok, ein, mErr := s.mintSessionToken(sess.UserID, id, "full"); mErr != nil {
+		slog.Error("mint session token failed", "err", mErr)
+	} else {
+		accessToken, expiresIn = tok, ein
+	}
+
 	writeJSON(w, http.StatusOK, refreshResp{
-		AccessToken: tr.AccessToken,
-		ExpiresIn:   tr.ExpiresIn,
+		AccessToken: accessToken,
+		ExpiresIn:   expiresIn,
 		User:        user,
 		DeviceName:  sess.DeviceName,
 	})
@@ -369,10 +410,11 @@ type tokenIdentity struct {
 
 // extractIdentity parses {sub, preferred_username | name | email, avatar | picture,
 // matchClaim, groups} from the id_token if available, else the access_token. The
-// signature is NOT verified here — for OIDC sessions the auth middleware verifies
-// the access_token on every API call via JWKS, so any tamper surfaces there. (Once
-// OIDC sessions migrate to cdrop self-signed access tokens, this becomes the only
-// trust point and MUST then verify the id_token signature — AUTH.md §5.)
+// signature is NOT verified here — callers verify separately around it: at login
+// (handleAuthExchange) the id_token signature is checked via VerifyIDToken before
+// the extracted subject is trusted to mint a self token; at refresh the IdP just
+// authenticated the refresh_token over a TLS back-channel, so the token it returns
+// is trusted by transport. Either way the extracted fields are sound. (AUTH.md §5.)
 func extractIdentity(idToken, accessToken, matchClaim string) (tokenIdentity, error) {
 	pick := idToken
 	if pick == "" {