鉴权并入 Auth Broker：委派设备会话统一模型 + 四端迁移

后端（委托 Auth Broker，路径 A）：
- 删自建鉴权（OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts），cdrop 不再存任何凭证；鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头（dev 旁路保留）；Claims 加 Tier() / Guest()
- internal/brokerclient：mint / revoke（带 X-Broker-App）/ refresh / ListSessions（R1 列举），直连内网、吊销幂等

统一会话模型“委派设备会话”（Delegated Device Sessions）：
- 每个客户端（浏览器 / 桌面 / 扫码设备）＝一条带 meta(device_id) + label 的 broker 机器会话；Broker 作设备会话唯一注册表（R1 按用户＋app 列举 + R2 按 (user,app,meta) 幂等铸造），cdrop 退化为薄覆盖层、不再自存权威会话表
- 新增代铸端点 POST /api/auth/device-session：凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话（meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流）；R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备
- 会话列表＝R1 权威 + 叠加 type（本地缓存）/ online（Hub presence，按设备名）/ current（meta 匹配本请求 X-Auth-Meta）+ 过滤 meta=""（device-authorize 引导会话残留）；devices 表降级为 type/presence 薄缓存（非会话权威），device_id 主键、upsert 按 user 限定
- 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App；扫码登录保留三密钥编排，collect 改委托 broker 铸 + 落缓存行

Web 前端：
- 登录走 broker 全局 SSO 代跳（/api/auth/login 302）；bootstrap 经 /api/me 注入身份后代铸设备会话（稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造）；refresh 走 /api/auth/refresh
- 设备管理按 device_id；改名＝同 device_id 重代铸（R2 原地轮换换 label、不产生重复行）；登录页反应式守卫修登录回环
- 去 OIDC PKCE / step-up（删 oauth.callback / stepUp）

桌面客户端（Wails）：
- loopback PKCE（RFC 8252）改指 broker 设备授权流（/device/authorize + /device/token）拿引导令牌，再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销；身份取自代铸响应（修“显示名显示为 UUID”）；refresh 保留显示名；稳定 device_id 入桌面配置

iOS 客户端（arch A，原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥）：
- 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化（此前实现，随本次落入版本库）
- 鉴权＝引擎自刷（boot 注入 refresh_token）+ broker 轮换经 sessionRotated 回报原生更新 Keychain；去 cookie 同步；Session 加 refreshToken / deviceId

实时 / 健壮性：
- presence 走 Hub union（设备表行 ∪ 表外实时连接，按名去重、live-only 标在线）
- Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内，消除 close-vs-send 闭通道 send panic（revoke 每次 Kick 后该路径变热）

配置 / 删旧栈：
- config 改 broker 接入（CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL），prod 强校验 broker 配置 + PUBLIC_URL（CSRF Origin 守卫不失效）
- 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表（web_sessions / accounts / shortcut_tokens）及验证链；.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型（人机分流 + 公开端点放行 + X-Auth-Meta 透传）
- 测试全重写：QR / 会话含 mock broker（R1 列举 + R2 幂等）；hub 加 close-vs-send 并发回归；config 加 prod 必填校验

desktop/app.go

@@ -13,26 +13,12 @@ import (
 	"cdrop-desktop/platform"
 )
 
-// loginResultFromToken decodes the identity out of the exchanged tokens and
-// assembles the payload the WebView store consumes. Shared by login + refresh.
-func loginResultFromToken(tok *platform.TokenResult) (*platform.LoginResult, error) {
-	user, err := platform.UserFromToken(tok.IDToken, tok.AccessToken)
-	if err != nil {
-		return nil, err
-	}
-	return &platform.LoginResult{
-		AccessToken:  tok.AccessToken,
-		RefreshToken: tok.RefreshToken,
-		ExpiresIn:    tok.ExpiresIn,
-		User:         user,
-	}, nil
-}
-
 // App is the Wails application context bound to the WebView.
 type App struct {
 	ctx         context.Context
 	apiBase     string
 	token       *platform.TokenResult // in-memory copy; refresh_token persists in the OS secret store (see session.go)
+	user        platform.UserInfo     // display identity from 代铸; preserved across refresh (machine tokens are nameless)
 	quitting    bool                  // set by the menu bar "Quit" so beforeClose allows the real exit
 	startHidden bool                  // set by main when launched via autostart: come up to the menu bar, no window
 
@@ -58,6 +44,7 @@ func (a *App) startup(ctx context.Context) {
 			RefreshToken: s.RefreshToken,
 			ExpiresIn:    s.ExpiresIn,
 		}
+		a.user = s.User
 	}
 	// Keep the autostart entry in sync with this binary: when it's enabled,
 	// re-apply so an entry written by an older build (no --hidden flag) or one
@@ -222,17 +209,40 @@ func (a *App) StartLogin() {
 		flow := platform.NewFlow(cfg, func(u string) {
 			runtime.BrowserOpenURL(a.ctx, u)
 		})
-		tok, err := flow.Login(a.ctx)
+		// Step 1: device-authorize → a bootstrap machine token (proves identity, no meta).
+		boot, err := flow.Login(a.ctx)
 		if err != nil {
 			runtime.EventsEmit(a.ctx, "oauth:error", map[string]string{"detail": err.Error()})
 			return
 		}
-		res, err := loginResultFromToken(tok)
+		// Step 2: 代铸 the bootstrap token into a cdrop-managed device session bound to this
+		// device's stable device_id, so the desktop is managed exactly like a browser. The
+		// device session's tokens supersede the bootstrap (which is discarded, left to expire).
+		deviceID, err := platform.ResolveDeviceID()
 		if err != nil {
 			runtime.EventsEmit(a.ctx, "oauth:error", map[string]string{"detail": err.Error()})
 			return
 		}
-		a.token = tok
+		ds, err := platform.MintDeviceSession(a.ctx, a.apiBase, boot.AccessToken, deviceID, platform.ResolveDeviceName(), platform.DeviceType())
+		if err != nil {
+			runtime.EventsEmit(a.ctx, "oauth:error", map[string]string{"detail": err.Error()})
+			return
+		}
+		// Identity from the verified 代铸 response (X-Auth-Subject / X-Auth-Name / X-Auth-Avatar),
+		// so the real display name and picture show rather than the subject UUID a nameless
+		// machine token yields.
+		user := platform.UserInfo{ID: ds.UserID, Name: ds.Name, Avatar: ds.Avatar}
+		if user.Name == "" {
+			user.Name = user.ID
+		}
+		res := &platform.LoginResult{
+			AccessToken:  ds.AccessToken,
+			RefreshToken: ds.RefreshToken,
+			ExpiresIn:    ds.ExpiresIn,
+			User:         user,
+		}
+		a.token = &platform.TokenResult{AccessToken: ds.AccessToken, RefreshToken: ds.RefreshToken, ExpiresIn: ds.ExpiresIn}
+		a.user = user
 		if err := platform.SaveSession(*res); err != nil {
 			runtime.LogWarningf(a.ctx, "persist session failed: %v", err)
 		}
@@ -262,9 +272,15 @@ func (a *App) Refresh() (*platform.SessionView, error) {
 	if tok.RefreshToken == "" {
 		tok.RefreshToken = a.token.RefreshToken // providers that don't rotate: keep the old one
 	}
-	res, err := loginResultFromToken(tok)
-	if err != nil {
-		return nil, err
+	// Preserve the identity established at login: the refreshed access token is a nameless
+	// machine token (it carries meta, not the display name), so re-deriving identity from it
+	// would regress the name to the subject UUID. The device session keeps its meta across
+	// rotation, so the device stays the same managed device.
+	res := &platform.LoginResult{
+		AccessToken:  tok.AccessToken,
+		RefreshToken: tok.RefreshToken,
+		ExpiresIn:    tok.ExpiresIn,
+		User:         a.user,
 	}
 	a.token = tok
 	if err := platform.SaveSession(*res); err != nil {
@@ -368,11 +384,11 @@ func (a *App) EffectiveDownloadDir() string {
 	return platform.ResolveDownloadDir()
 }
 
-// resolveOAuthConfig prefers explicit env overrides (dev / a pinned client);
-// otherwise it fetches /api/auth/config from the backend and reuses the web
-// app's client_id for the desktop's loopback PKCE flow (see desktop/PLAN.md §3).
+// resolveOAuthConfig prefers explicit env overrides (dev / a pinned broker);
+// otherwise it fetches /api/auth/config from the backend for the broker's public URL,
+// then runs the broker device-authorization flow against it.
 func (a *App) resolveOAuthConfig() (platform.OAuthConfig, error) {
-	if env := oauthConfigFromEnv(); env.ClientID != "" {
+	if env := oauthConfigFromEnv(); env.BrokerURL != "" {
 		return env, nil
 	}
 	return platform.FetchOAuthConfig(a.ctx, a.apiBase)
@@ -380,10 +396,8 @@ func (a *App) resolveOAuthConfig() (platform.OAuthConfig, error) {
 
 func oauthConfigFromEnv() platform.OAuthConfig {
 	return platform.OAuthConfig{
-		AuthorizeURL: os.Getenv("CDROP_OAUTH_AUTHORIZE_URL"),
-		TokenURL:     os.Getenv("CDROP_OAUTH_TOKEN_URL"),
-		ClientID:     os.Getenv("CDROP_OAUTH_CLIENT_ID"),
-		Scopes:       os.Getenv("CDROP_OAUTH_SCOPES"),
+		BrokerURL: os.Getenv("CDROP_BROKER_URL"),
+		App:       envOr("CDROP_BROKER_APP", "cdrop"),
 	}
 }