设备名与令牌解耦 + iOS Broker 应用内登录 / 消息 / 图库 / 记录持久化 + 三端 bug 修复

设备名与令牌解耦（presence 按 device_id 键控）：
- hub 主键改稳定 device_id（presence / online / kick 用之），peer 路由仍按设备名经 hub 内 clientFor 解析——不动传输核心；Client 加 Name + 连接键，PresenceDevice 加 device_id，sse 传 claims.DeviceID，publishPresence 按 device_id 判在线、name 取自 devices 表
- 改名走已有 PATCH /api/devices/{device_id}（不重铸会话、不换 token、不中断 SSE）+ hub.Rename 更新活跃连接名 + 重广播 presence，全端即时无重复项；sessions 列表 name 用 devices 表覆盖 broker Label；web 改名从重铸迁到 PATCH，iOS 设置页即时改名；DeviceItem / DeviceInfo 按 device_id 键控判本机
- 移除「需移除两次」：publishPresence 不再把「有 device_id 但无 devices 行」的 live 连接当在线（吊销后用未过期 token 重连的僵尸），只显示 code-less 连接；合法重登新建行故正常
- revoke 对无 broker 会话的本地行也清（清掉合成测试 / 幽灵设备）；跨端吊销 / 断连一律按 device_id Kick

iOS Broker 应用内登录（免扫码）：
- BrokerLogin.swift：ASWebAuthenticationSession 跑 broker /device/authorize + /device/token 的 PKCE 设备授权流（对齐桌面 loopback，自定义 scheme cdrop://auth-callback 回调）→ /api/auth/device-session 代铸出带真名 + 稳定 device_id 的设备会话；DeviceIDStore 跨登录复用 device_id 杜绝重登重复
- LoginView 主登录改 broker 账号登录、扫码降级为可展开备选

iOS 功能补全：
- 设备间消息（引擎 main.ts 单条增量过桥 + onNativeEvent sendMessage；EngineController 消息状态 + 新 MessagesView 会话 UI；后端 /api/message 已就绪）
- 图库发送（PhotosPicker 文件 / 图库菜单 → stagePhotoData → 复用 cdrop-file 发送链路；NSPhotoLibraryUsageDescription）
- 传输历史 / 消息记录持久化（RecordsStore 落 Application Support JSON，跨重启存活）+ 长按删除 + 清空（二次确认）
- 进行中传输主动取消 / 立即切中继（详情页两按钮，复用引擎桥命令）
- 身份愈合（引擎 /api/me 取真实显示名经 identityUpdated 回报 Keychain，修扫码登录「用户显示 UUID」）
- 触发本地网络权限（NWBrowser 浏览 _cdrop._tcp）使 WKWebView WebRTC 取 host 候选

iOS 发送 / 启动修复：
- 发送在读文件即失败：引擎在 https 源下 fetch("cdrop-file://") 跨源 + Range 头触发 CORS 预检被拦 → 改走原生桥 bridgeFileSource / readFileSlice（512 KiB 分块 base64），绕开 CORS、整文件仍不整体进内存
- 冷启重开「missing injected session」：EngineWebView.makeUIView 在 boot 注入前确定性接好 auth，消除注入竞态

桌面 bug 修复：
- 登出静默失败：window.confirm 在 Wails WebView 失效（返回 falsy 致动作被静默跳过）→ 跨平台 DOM 确认弹窗（utils/confirm 的 Promise 式 confirmDialog + ui/ConfirmHost 的 Mantine Modal）取代之；登出改 await 先吊销 broker 会话再清本地（桌面 clearDesktopSession 会丢 Go 侧 refresh 的竞态）
- 扫 iOS 登录二维码被拒「不是本站的码」：wails:// 源永不等 https 站点源 → 桌面放宽 parseLinkApprovalUrl 的 origin 等值校验（仍留 /link 路径 + r/c；批准 r/c 一律发往本端后端、外站码只 404，无开放重定向）
- macOS 本地网络权限触发（localnetwork_darwin NWBrowser + Info.plist 键）；相机修复（NSCameraUsageDescription）

web / 跨端：
- presence 透传 device_id + 离线检测按 device_id；会话列表随 presence 防抖重拉（已登出设备自动从列表消失，不再需手动刷新）；移除设备 / 清剪贴板 / 撤销令牌 / 登出均改 DOM 确认弹窗

分发 / 签名：
- 真机签名从手动 scaffold 改自动 provisioning（删 Signing.xcconfig，project.yml 去 profile specifier，just ios-device 用 -allowProvisioningUpdates + ASC 团队 key）；App Group 改名 group.net.commilitia.Commilitia-Drop（含 entitlements）
- hub 测试加 device_id 键控 + 改名解耦回归（-race）

internal/httpapi/sessions.go

@@ -69,10 +69,16 @@ func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
 	// logged-out device's row is reaped there, not on this read path — this GET stays
 	// side-effect-free, and the session list itself is always R1-authoritative regardless of
 	// any stale cache row (the row only ever supplies a type for a device that is in R1).
+	// device_id -> cached type + live name. The name overlay is what keeps the session list
+	// consistent after a decoupled rename: the broker Label is only set at mint time and does
+	// not follow a PATCH /api/devices rename, so we prefer the devices-table name (the same
+	// source presence uses) and fall back to the broker Label only for a row-less session.
 	typeByID := map[string]string{}
+	nameByID := map[string]string{}
 	if devs, err := s.queries.ListDevicesByUser(r.Context(), claims.UserID); err == nil {
 		for _, d := range devs {
 			typeByID[d.DeviceID] = d.Type
+			nameByID[d.DeviceID] = d.Name
 		}
 	}
 
@@ -88,6 +94,10 @@ func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
 		if typ == "" {
 			typ = "browser"
 		}
+		name := nameByID[sess.Meta]
+		if name == "" {
+			name = sess.Label
+		}
 		scope := "full"
 		if jwtauth.ScopeTier(sess.Scope) == "guest" {
 			scope = "guest"
@@ -95,11 +105,11 @@ func (s *Server) handleSessionsList(w http.ResponseWriter, r *http.Request) {
 		out = append(out, sessionView{
 			ID:         sess.Meta,
 			DeviceID:   sess.Meta,
-			DeviceName: sess.Label,
+			DeviceName: name,
 			Kind:       typ,
 			Scope:      scope,
 			Current:    sess.Meta == claims.DeviceID,
-			Online:     s.hub.Online(claims.UserID, sess.Label),
+			Online:     s.hub.Online(claims.UserID, sess.Meta),
 			CreatedAt:  sess.CreatedAt,
 			LastUsedAt: sess.LastUsedAt,
 		})
@@ -133,9 +143,11 @@ func (s *Server) handleSessionRevoke(w http.ResponseWriter, r *http.Request) {
 // pruned cache row still revokes correctly and stays authorized to this user.
 func (s *Server) revokeDevice(r *http.Request, userID, deviceID string) (int, bool) {
 	sid, name := "", ""
+	localRowOwned := false
 	if dev, err := s.queries.GetDevice(r.Context(), deviceID); err == nil && dev.UserID == userID {
 		sid = dev.BrokerSid
 		name = dev.Name
+		localRowOwned = true
 	}
 	if sid == "" {
 		sessions, err := s.broker.ListSessions(r.Context(), userID)
@@ -152,8 +164,22 @@ func (s *Server) revokeDevice(r *http.Request, userID, deviceID string) (int, bo
 		}
 	}
 	if sid == "" {
-		// Not this user's device, or already gone from both the cache and the broker.
-		return http.StatusNotFound, false
+		// No broker session for this device_id. If we still own a local cache row, it is a stale /
+		// phantom entry — a synthetic test device (the Diag residue) or a row whose broker session
+		// is long gone. Drop the local row + kick + republish so the user can always clear such a
+		// device from their list; only a device_id we own nothing for is a genuine 404.
+		if !localRowOwned {
+			return http.StatusNotFound, false
+		}
+		if _, err := s.queries.DeleteDevice(r.Context(), db.DeleteDeviceParams{
+			DeviceID: deviceID,
+			UserID:   userID,
+		}); err != nil {
+			slog.Warn("delete phantom device cache failed", "err", err, "user", userID, "device", deviceID)
+		}
+		s.hub.Kick(userID, deviceID, name)
+		s.hub.PublishPresence(r.Context(), userID)
+		return http.StatusNoContent, true
 	}
 	// Revoke the broker session first so the device can't refresh; a 404 (already gone) is
 	// idempotent success inside RevokeSession.
@@ -169,9 +195,10 @@ func (s *Server) revokeDevice(r *http.Request, userID, deviceID string) (int, bo
 		// and the next list-prune clean it). Report success so the client sees the logout.
 		slog.Warn("delete device cache failed", "err", err, "user", userID, "device", deviceID)
 	}
-	if name != "" {
-		s.hub.Kick(userID, name)
-	}
+	// Kick by the stable device_id (the hub key); name rides along for the code-less fallback
+	// path inside Kick. This makes cross-device revoke land reliably (the prior name-keyed Kick
+	// could miss a renamed device, leaving it able to keep refreshing — the "移除失败" symptom).
+	s.hub.Kick(userID, deviceID, name)
 	s.hub.PublishPresence(r.Context(), userID)
 	return http.StatusNoContent, true
 }