登录子系统：OIDC 统一自签 token + 吊销即时生效 + 设备并入会话列表 + 应用内扫码 + 禁则修复

接续 90a3790（扫码 A0+A1+B + step-up 雏形）。蓝本见 AUTH.md。

OIDC 统一到 cdrop 自签 token
- /auth/exchange 先 JWKS 验 id_token 签名（自签 token 的唯一信任锚）再签 cdrop
  自签 HS256 access token（绑 sid），不再把 IdP RS256 下发浏览器；验签失败仅告警
  并回退 RS256（会话仍建、下次 refresh 自愈），登录不中断
- /auth/refresh oidc 路径仍打 IdP 轮换 refresh_token + 探测 IdP 侧吊销，但同样回
  自签 token；createWebSession 改返回行 id
- verify 链保留 RS256 分支仅供桌面端 loopback（其即时吊销留后续）

吊销即时生效 + 被吊销设备自知回退
- verifySelfToken 每请求按 sid 查 web_sessions 行，行删即拒 → 吊销在被吊销设备
  下一次请求即生效（不等 TTL），oidc / self / guest 一致
- 前端仅在「服务端以 401 确证会话失效」时 forceLogout 清登录态、回登录页；短期连接
  失败（5xx / 网络）一律保留登录态（refreshTokens 改三态 refreshed/invalid/transient，
  cookieRefresh 改 discriminated 结果）
- __root 反应式守卫：prod 下失登录态且非认证路由即跳登录页；新增 auth.sessionLost.* 三语

设备列表并入会话列表 + 孤儿自动清除
- GET /api/auth/sessions 统一 web_sessions 与原生客户端设备（桌面 / iOS，自 devices
  登记表呈现，native=true，离线也列）；同名不重复列出，排除 shortcut 与无会话 browser
- 吊销网页会话连带删其设备登记（无同名在用会话时）；原生「登出」走
  DELETE /api/devices/{name}（同要求 step-up）
- 新增 DeleteOrphanBrowserDevices（browser 型且无存活 web_session），接入设备清扫器（1h）

应用内扫码 + 聚珍崩溃 / CJK 禁则修复
- 登录页内置 getUserMedia + jsqr 扫码，不再外跳系统应用（避免开错浏览器）
- 修聚珍（cjk-autospace）MutationObserver 与 React 重渲染同子树冲突致的 insertBefore
  崩溃：扫码 / 显码 / 批准三状态机页整页跳过聚珍（data-jz-skip）
- 修流动正文未跑 CJK 禁则（jinze 为段落级、须 opt-in）：设置 / 快捷指令 / 桌面页一批
  hint 补 data-jz-level="paragraph" + justify，短标签 / 状态仍留文本级

step-up 完善
- auth_time 改可选（Casdoor 不下发，原强制致死循环）；stepped_up_at 按会话绑定、
  StepUpMaxAgeSeconds 窗口内不复要求；新增 POST /api/auth/stepup
- 批准页 persist 编进 step-up returnTo 防整页跳转丢失；scope 随档绑定（信任=full /
  仅此次=guest），默认偏安全的「仅此次」

文档与测试
- AUTH.md：折中架构、accounts 薄表、令牌架构、扫码流程、step-up、§4.4 统一会话列表
- 新增 Go 测试：OIDC 自签验证、verifySelfToken 吊销即拒、会话吊销连带删设备、
  统一会话列表（含原生 / 不含 shortcut / 不重复）、孤儿清扫、删设备需 step-up

internal/httpapi/qr.go

@@ -285,7 +285,9 @@ func (s *Server) handleQRRequest(w http.ResponseWriter, r *http.Request) {
 		RequestIP:  req.RequestIp,
 		ExpiresAt:  req.ExpiresAt,
 		Status:     req.Status,
-		StepUp:     s.cfg.StepUpEnabled,
+		// Tell the approver UI to re-auth only if step-up is on AND this session
+		// hasn't recently stepped up (within the window) — no repeated prompts (#3).
+		StepUp: s.cfg.StepUpEnabled && !s.sessionRecentlySteppedUp(r),
 	})
 }
 
@@ -309,10 +311,14 @@ func (s *Server) handleQRApprove(w http.ResponseWriter, r *http.Request) {
 
 	// Step-up: approving a new device into your account is sensitive. When enabled,
 	// require a fresh prompt=login re-auth (the provider's 2FA, if configured, is
-	// enforced during that exchange) within the freshness window (AUTH.md §6).
-	if s.cfg.StepUpEnabled && !s.verifyStepUp(r, claims.UserID, body.StepUpCode, body.StepUpVerifier) {
-		writeJSON(w, http.StatusForbidden, map[string]string{"error": "step_up_required"})
-		return
+	// enforced during that exchange) — UNLESS this session already stepped up within
+	// the freshness window, so the same session isn't re-prompted repeatedly (#3).
+	if s.cfg.StepUpEnabled && !s.sessionRecentlySteppedUp(r) {
+		if !s.verifyStepUp(r, claims.UserID, body.StepUpCode, body.StepUpVerifier) {
+			writeJSON(w, http.StatusForbidden, map[string]string{"error": "step_up_required"})
+			return
+		}
+		s.recordStepUp(r)
 	}
 
 	scope := "guest" // this milestone grants restricted guest sessions only
@@ -367,6 +373,50 @@ func (s *Server) handleQRDeny(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// sessionFromCookie resolves the caller's web_session row from the cdrop_session
+// cookie. The scan-approval endpoints live under /api/auth/*, which the cookie's
+// Path covers, so both OIDC and self sessions can be located here.
+func (s *Server) sessionFromCookie(r *http.Request) (db.WebSession, bool) {
+	c, err := r.Cookie(sessionCookieName)
+	if err != nil || c.Value == "" {
+		return db.WebSession{}, false
+	}
+	sess, err := s.queries.GetWebSession(r.Context(), sessionID(c.Value))
+	if err != nil {
+		return db.WebSession{}, false
+	}
+	return sess, true
+}
+
+// sessionRecentlySteppedUp reports whether the caller's session passed step-up
+// within StepUpMaxAgeSeconds — so a sensitive action skips re-auth and the same
+// session isn't re-prompted repeatedly (#3, AUTH.md §6).
+func (s *Server) sessionRecentlySteppedUp(r *http.Request) bool {
+	sess, ok := s.sessionFromCookie(r)
+	if !ok || sess.SteppedUpAt == 0 {
+		return false
+	}
+	window := int64(s.cfg.StepUpMaxAgeSeconds)
+	if window <= 0 {
+		window = 300
+	}
+	return time.Now().Unix()-sess.SteppedUpAt <= window
+}
+
+// recordStepUp stamps the caller's session as freshly stepped-up.
+func (s *Server) recordStepUp(r *http.Request) {
+	sess, ok := s.sessionFromCookie(r)
+	if !ok {
+		return
+	}
+	if err := s.queries.SetSessionSteppedUp(r.Context(), db.SetSessionSteppedUpParams{
+		SteppedUpAt: time.Now().Unix(),
+		ID:          sess.ID,
+	}); err != nil {
+		slog.Warn("record step-up failed", "err", err)
+	}
+}
+
 // verifyStepUp exchanges a fresh prompt=login authorization code and confirms it
 // proves a recent interactive re-authentication by the same user: the id_token's
 // signature validates (JWKS), its sub matches the caller, and its auth_time is
@@ -401,11 +451,19 @@ func (s *Server) verifyStepUp(r *http.Request, userID, code, verifier string) bo
 	if sub != userID {
 		return false
 	}
-	maxAge := int64(s.cfg.StepUpMaxAgeSeconds)
-	if maxAge <= 0 {
-		maxAge = 300
+	// Enforce the freshness window only when the IdP supplied auth_time (Casdoor
+	// omits it). When absent, the fresh single-use prompt=login code — exchanged
+	// once, just now — is itself the bound on how recent the re-auth was.
+	if authTime > 0 {
+		maxAge := int64(s.cfg.StepUpMaxAgeSeconds)
+		if maxAge <= 0 {
+			maxAge = 300
+		}
+		if time.Now().Unix()-authTime > maxAge {
+			return false
+		}
 	}
-	return time.Now().Unix()-authTime <= maxAge
+	return true
 }
 
 // lookupQRRequest fetches a request and verifies the approval_code in constant