鉴权并入 Auth Broker：委派设备会话统一模型 + 四端迁移

后端（委托 Auth Broker，路径 A）：
- 删自建鉴权（OIDC exchange / 自签会话 / step-up / shortcut / web_sessions / accounts），cdrop 不再存任何凭证；鉴权中间件改读边缘注入的 X-Auth-Subject/Scope/Meta/Name/Roles 头（dev 旁路保留）；Claims 加 Tier() / Guest()
- internal/brokerclient：mint / revoke（带 X-Broker-App）/ refresh / ListSessions（R1 列举），直连内网、吊销幂等

统一会话模型“委派设备会话”（Delegated Device Sessions）：
- 每个客户端（浏览器 / 桌面 / 扫码设备）＝一条带 meta(device_id) + label 的 broker 机器会话；Broker 作设备会话唯一注册表（R1 按用户＋app 列举 + R2 按 (user,app,meta) 幂等铸造），cdrop 退化为薄覆盖层、不再自存权威会话表
- 新增代铸端点 POST /api/auth/device-session：凭边缘已验明的 X-Auth-Subject 委托 broker 铸 / 轮换设备会话（meta=device_id、按调用方 tier 防越权、sameOrigin CSRF、per-IP 限流）；R2 幂等保证同一 device_id 重登原地轮换、不堆重复设备
- 会话列表＝R1 权威 + 叠加 type（本地缓存）/ online（Hub presence，按设备名）/ current（meta 匹配本请求 X-Auth-Meta）+ 过滤 meta=""（device-authorize 引导会话残留）；devices 表降级为 type/presence 薄缓存（非会话权威），device_id 主键、upsert 按 user 限定
- 吊销按 device_id → 缓存优先 / R1 兜底解析 sid → broker 吊销 + X-Broker-App；扫码登录保留三密钥编排，collect 改委托 broker 铸 + 落缓存行

Web 前端：
- 登录走 broker 全局 SSO 代跳（/api/auth/login 302）；bootstrap 经 /api/me 注入身份后代铸设备会话（稳定 device_id 存 localStorage、Web Locks 跨 tab 串行防重复铸造）；refresh 走 /api/auth/refresh
- 设备管理按 device_id；改名＝同 device_id 重代铸（R2 原地轮换换 label、不产生重复行）；登录页反应式守卫修登录回环
- 去 OIDC PKCE / step-up（删 oauth.callback / stepUp）

桌面客户端（Wails）：
- loopback PKCE（RFC 8252）改指 broker 设备授权流（/device/authorize + /device/token）拿引导令牌，再代铸出带 meta 的托管设备会话——与浏览器同模型、同管理、同吊销；身份取自代铸响应（修“显示名显示为 UUID”）；refresh 保留显示名；稳定 device_id 入桌面配置

iOS 客户端（arch A，原生 SwiftUI + 离屏无头 WebView 引擎 + 原生↔JS 桥）：
- 引擎 / 文件管理 / 设备管理 / 应用图标 / 本地化（此前实现，随本次落入版本库）
- 鉴权＝引擎自刷（boot 注入 refresh_token）+ broker 轮换经 sessionRotated 回报原生更新 Keychain；去 cookie 同步；Session 加 refreshToken / deviceId

实时 / 健壮性：
- presence 走 Hub union（设备表行 ∪ 表外实时连接，按名去重、live-only 标在线）
- Hub 通道 close 一律在写锁内、非阻塞 send 一律在读锁内，消除 close-vs-send 闭通道 send panic（revoke 每次 Kick 后该路径变热）

配置 / 删旧栈：
- config 改 broker 接入（CDROP_BROKER_* / CDROP_PUBLIC_URL / 按档 TTL），prod 强校验 broker 配置 + PUBLIC_URL（CSRF Origin 守卫不失效）
- 删 auth.go / selftoken.go / shortcut.go / jwks.go + 三表（web_sessions / accounts / shortcut_tokens）及验证链；.env.example / compose.snippet.yaml / Caddyfile.snippet 更新为 broker 模型（人机分流 + 公开端点放行 + X-Auth-Meta 透传）
- 测试全重写：QR / 会话含 mock broker（R1 列举 + R2 幂等）；hub 加 close-vs-send 并发回归；config 加 prod 必填校验

internal/db/queries/accounts.sql

@@ -1,22 +0,0 @@
--- accounts: cdrop-side thin account data (AUTH.md 2.1). Keyed on user_id (= OIDC
--- sub). No credentials live here; password / second factor stay at the OAuth
--- provider. Upserted on every successful OIDC exchange.
---
--- ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and
--- corrupts every generated SQL const in the file. Keep this file pure ASCII.
-
--- name: UpsertAccount :exec
-INSERT INTO accounts (user_id, match_key, display_name, avatar_url, roles, provider, created_at, last_login_at)
-VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-ON CONFLICT(user_id) DO UPDATE SET
-    match_key = excluded.match_key,
-    display_name = excluded.display_name,
-    avatar_url = excluded.avatar_url,
-    roles = excluded.roles,
-    provider = excluded.provider,
-    last_login_at = excluded.last_login_at;
-
--- name: GetAccount :one
-SELECT user_id, match_key, display_name, avatar_url, roles, provider, created_at, last_login_at
-FROM accounts
-WHERE user_id = ?;

internal/db/queries/devices.sql

@@ -1,34 +1,54 @@
--- name: UpsertDevice :exec
-INSERT INTO devices (user_id, name, type, last_seen)
-VALUES (?, ?, ?, ?)
-ON CONFLICT (user_id, name) DO UPDATE SET
+-- devices: cdrop-managed devices (scan-login / native pairing). device_id is a
+-- stable opaque cdrop-generated id that doubles as the session<->device join key
+-- (passed to the broker as meta, echoed back as X-Auth-Meta on /verify). broker_sid
+-- is the broker's session id, stored privately to revoke on device removal. tier is
+-- a redundant cache of the broker scope (full/guest). name is human-readable and can
+-- change without changing the device's identity (device_id is the key).
+--
+-- ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and corrupts
+-- every generated SQL const in the file. Keep this file pure ASCII.
+
+-- CreateDevice records a device on scan-login collect / proxy-mint (or native pairing). Keyed
+-- on device_id, so a re-pair with the same id refreshes the row (incl. the new broker_sid).
+-- The WHERE on the upsert scopes the update to the owning user so a (cryptographically
+-- impossible) cross-user device_id collision can never reassign the row owner; user_id is
+-- immutable for a given device_id.
+-- name: CreateDevice :exec
+INSERT INTO devices (device_id, user_id, name, type, tier, broker_sid, created_at, last_seen)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+ON CONFLICT (device_id) DO UPDATE SET
+    name = excluded.name,
     type = excluded.type,
-    last_seen = excluded.last_seen;
+    tier = excluded.tier,
+    broker_sid = excluded.broker_sid,
+    last_seen = excluded.last_seen
+WHERE devices.user_id = excluded.user_id;
+
+-- TouchDevice refreshes last_seen + tier on each authenticated request. Update-only:
+-- the row is created at collect time, so a missing row (e.g. a device authorized via
+-- the broker's own device flow, not cdrop's) simply isn't cdrop-managed and no-ops.
+-- name: TouchDevice :exec
+UPDATE devices SET last_seen = ?, tier = ? WHERE device_id = ? AND user_id = ?;
 
 -- name: ListDevicesByUser :many
-SELECT user_id, name, type, last_seen
+SELECT device_id, user_id, name, type, tier, broker_sid, created_at, last_seen
 FROM devices
 WHERE user_id = ?
 ORDER BY name;
 
--- name: DeleteStaleDevices :exec
-DELETE FROM devices
-WHERE last_seen < ?;
-
--- DeleteOrphanBrowserDevices removes browser device rows with no live web_session
--- (the session was revoked or expired), keeping the device list aligned with the
--- session list. The ? is the current epoch second. Native (macos/windows/linux/ios)
--- and shortcut devices are left alone: they legitimately keep no web_session.
--- name: DeleteOrphanBrowserDevices :execrows
-DELETE FROM devices
-WHERE type = 'browser'
-  AND NOT EXISTS (
-    SELECT 1 FROM web_sessions ws
-    WHERE ws.user_id = devices.user_id
-      AND ws.device_name = devices.name
-      AND ws.expires_at > ?
-  );
+-- name: GetDevice :one
+SELECT device_id, user_id, name, type, tier, broker_sid, created_at, last_seen
+FROM devices
+WHERE device_id = ?;
 
 -- name: DeleteDevice :execrows
 DELETE FROM devices
-WHERE user_id = ? AND name = ?;
+WHERE device_id = ? AND user_id = ?;
+
+-- name: RenameDevice :execrows
+UPDATE devices SET name = ?
+WHERE device_id = ? AND user_id = ?;
+
+-- name: DeleteStaleDevices :exec
+DELETE FROM devices
+WHERE last_seen < ?;

internal/db/queries/shortcut_tokens.sql

@@ -1,32 +0,0 @@
--- shortcut_tokens: long-lived, scope-limited, revocable HS256 tokens for the
--- iOS Shortcut clipboard sync. Count backs the per-user cap; Revoke is scoped by
--- user_id to block cross-user revocation; Touch records last use asynchronously.
-
--- name: InsertShortcutToken :exec
-INSERT INTO shortcut_tokens (jti, user_id, label, scopes, created_at, expires_at)
-VALUES (?, ?, ?, ?, ?, ?);
-
--- name: GetShortcutToken :one
-SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
-FROM shortcut_tokens
-WHERE jti = ?;
-
--- name: ListShortcutTokensByUser :many
-SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
-FROM shortcut_tokens
-WHERE user_id = ?
-ORDER BY created_at DESC;
-
--- name: CountActiveShortcutTokensByUser :one
-SELECT COUNT(*) FROM shortcut_tokens
-WHERE user_id = ? AND revoked = 0 AND expires_at > ?;
-
--- name: RevokeShortcutToken :execrows
-UPDATE shortcut_tokens
-SET revoked = 1
-WHERE jti = ? AND user_id = ?;
-
--- name: TouchShortcutTokenUsed :exec
-UPDATE shortcut_tokens
-SET last_used_at = ?
-WHERE jti = ?;

internal/db/queries/web_sessions.sql

@@ -1,69 +0,0 @@
--- web_sessions: browser "passwordless re-login". The opaque cookie token is
--- never stored; id holds its SHA-256, so a DB leak yields no usable cookie.
--- refresh_token is AES-256-GCM ciphertext (key lives in the container env, not
--- the DB). 7-day sliding window: every refresh rotates the token and pushes
--- expires_at forward; idle sessions are reaped by DeleteExpiredWebSessions.
-
--- name: CreateWebSession :exec
-INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at)
-VALUES (?, ?, ?, ?, ?, ?, ?, ?);
-
--- name: GetWebSession :one
-SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by, stepped_up_at
-FROM web_sessions
-WHERE id = ?;
-
--- SetSessionSteppedUp stamps the moment this session last passed step-up re-auth;
--- sensitive actions within the freshness window then skip re-auth (AUTH.md 6).
--- name: SetSessionSteppedUp :exec
-UPDATE web_sessions
-SET stepped_up_at = ?
-WHERE id = ?;
-
--- name: RotateWebSession :exec
-UPDATE web_sessions
-SET refresh_token = ?, last_used_at = ?, expires_at = ?
-WHERE id = ?;
-
--- name: SetWebSessionDevice :exec
-UPDATE web_sessions
-SET device_name = ?
-WHERE id = ?;
-
--- name: DeleteWebSession :exec
-DELETE FROM web_sessions
-WHERE id = ?;
-
--- name: DeleteExpiredWebSessions :execrows
-DELETE FROM web_sessions
-WHERE expires_at < ?;
-
--- CreateSelfSession inserts a cdrop self-signed session (kind self/guest) that has
--- no IdP refresh_token (stored empty): refresh mints a fresh access token straight
--- from this row without touching the IdP. Used by QR scan-login (AUTH.md 4).
--- name: CreateSelfSession :exec
-INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, kind, scope, granted_by, created_at, last_used_at, expires_at)
-VALUES (?, ?, '', ?, ?, ?, ?, ?, ?, ?, ?);
-
--- SlideWebSession pushes a session's sliding window forward without rotating any
--- token. Self/guest sessions use it on refresh (they have no refresh_token to
--- rotate); oidc sessions keep using RotateWebSession.
--- name: SlideWebSession :exec
-UPDATE web_sessions
-SET last_used_at = ?, expires_at = ?
-WHERE id = ?;
-
--- ListWebSessionsByUser lists a user's sessions for the management UI (revoke
--- borrowed / guest devices). granted_by ties a scan-approved session to its
--- approver for cascade revocation.
--- name: ListWebSessionsByUser :many
-SELECT id, user_id, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
-FROM web_sessions
-WHERE user_id = ?
-ORDER BY last_used_at DESC;
-
--- DeleteWebSessionForUser drops one session scoped to its owner, so a user can
--- only revoke their own.
--- name: DeleteWebSessionForUser :execrows
-DELETE FROM web_sessions
-WHERE id = ? AND user_id = ?;