扫码登录：cdrop 自签会话原语 + 薄账户层 + 受限访客 + 2FA step-up

身份仍源自 OAuth provider（user_id = OIDC sub），cdrop 在其上自维护一薄层：
自签会话令牌 + accounts 表，并新增扫码快速登录。实施蓝本见 AUTH.md。

后端 · 自签会话原语
- web_sessions 加 kind/scope/granted_by 列（bootstrap 幂等迁移）；既有 oidc
  会话行为不变，新增 self（滑动续期）/ guest（受限·不续）两类
- cdrop 自签 HS256 会话 access token，密钥派生自 SESSION_SECRET，与落盘 AES、
  shortcut HS256 三密钥域隔离；jwtauth.verifySelfToken 无状态校验、靠 typ 区分
- requireFullSession 守卫：guest 会话不得改账号 / 再批准设备 / 签长效 token
- /auth/refresh 按 kind 分流：self/guest 纯自签、不触 IdP

后端 · 扫码登录（internal/httpapi/qr.go）
- qr/start・status・request・approve・deny 五端点 + login_requests 表 + reaper
- 三密钥分离：QR 仅含批准信息，会话只投递给持私有 poll_secret 的原设备
  （偷拍 QR 者无 poll_secret 领不到会话、未登录批不了准）
- 会话在新设备侧领取（cookie 不经手机）、单次消费、短 TTL

后端 · 薄账户层与 2FA step-up
- accounts 表（键 sub，不含任何凭证）：exchange/refresh upsert match_key /
  显示名 / 头像 / roles，供显示与未来管理员开启迁移标记时跨源关联
- step-up（默认关）：开启后 qr/approve 要求新鲜 prompt=login 授权码，后端就地
  换 id_token、JWKS 验签 + auth_time 窗口 + sub 匹配，provider 2FA 于此往返强制

前端（web/）
- 显码页 /link/new + 批准页 /link + net/qr.ts，对齐 Theme B、复用 AuthShell
  与聚珍排版管线、零新全局样式
- step-up 再认证流：批准前跑 prompt=login PKCE，回调分叉（不消费一次性 code、
  独立 state key）后带 step_up_code/verifier 调 approve
- 三语 i18n qr.*；新增 qrcode 依赖

修复 · clipboard sweeper（早已提交的损坏）
- ClearExpiredClipboards 因 clipboard.sql 全角注释触发 sqlc 1.31 多字节偏移
  bug，生成 SQL 被截断为「UPDATE clipboard_state SET content =」，sweeper 运行
  期报「incomplete input」、过期剪贴板内容从未清除（短 TTL 暴露保护失效）
- 注释改纯 ASCII 并加 bug 警告，重生成得完整 SQL；prod 已验证 sweeper 由 ERROR
  转为正常清理（cleared count=1）

构建
- .dockerignore：排除本地 node_modules 等，避免宿主原生二进制污染镜像内 vite 构建
- Dockerfile.base：GOPROXY 改为可经 --build-arg 覆盖（默认仍官方代理，受限网络
  构建时传区域镜像即可，仓库不固化区域值）

文档
- 新增 AUTH.md（账户与登录实施蓝本）；README 特性；.env.example /
  compose.snippet 增配置项（QR / 自签会话 TTL / step-up / match_claim）

测试
- 自签 token 密钥域隔离、扫码端到端（领取 / 单次 / poll_secret 校验 / deny /
  step-up 门）、extractIdentity、web_sessions 升级迁移

internal/db/queries/accounts.sql

@@ -0,0 +1,22 @@
+-- accounts: cdrop-side thin account data (AUTH.md 2.1). Keyed on user_id (= OIDC
+-- sub). No credentials live here; password / second factor stay at the OAuth
+-- provider. Upserted on every successful OIDC exchange.
+--
+-- ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and
+-- corrupts every generated SQL const in the file. Keep this file pure ASCII.
+
+-- name: UpsertAccount :exec
+INSERT INTO accounts (user_id, match_key, display_name, avatar_url, roles, provider, created_at, last_login_at)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+ON CONFLICT(user_id) DO UPDATE SET
+    match_key = excluded.match_key,
+    display_name = excluded.display_name,
+    avatar_url = excluded.avatar_url,
+    roles = excluded.roles,
+    provider = excluded.provider,
+    last_login_at = excluded.last_login_at;
+
+-- name: GetAccount :one
+SELECT user_id, match_key, display_name, avatar_url, roles, provider, created_at, last_login_at
+FROM accounts
+WHERE user_id = ?;

internal/db/queries/clipboard.sql

@@ -20,9 +20,14 @@ SELECT user_id, content_type, content, source_device, updated_at, version, origi
 FROM clipboard_state
 WHERE user_id = ?;
 
+-- ClearExpiredClipboards empties content older than the cutoff (content /
+-- source_device set NULL) for the short-TTL exposure limit; the row is kept.
+-- Called periodically by the clipboard sweeper.
+--
+-- ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and
+-- truncates the generated SQL const. This query was silently cut to "SET content ="
+-- (the sweeper then failed at runtime with "incomplete input"). Keep ASCII.
 -- name: ClearExpiredClipboards :execrows
--- 清除 updated_at 早于 cutoff 的剪贴板内容（content / source_device 置空），
--- 由 sweeper 周期调用实现短 TTL；保留行本身、仅抹掉内容。
 UPDATE clipboard_state
 SET content = NULL, source_device = NULL
 WHERE content IS NOT NULL AND updated_at < ?;

internal/db/queries/login_requests.sql

@@ -0,0 +1,39 @@
+-- login_requests: pending scan-login (QR) approvals (AUTH.md 2.3, 4). poll_secret
+-- is stored as its SHA-256 (the new device holds the plaintext); approval_code
+-- travels in the QR. Short-lived; reaped by DeleteExpiredLoginRequests.
+--
+-- ASCII only: sqlc 1.31.x miscomputes byte offsets on multibyte comments and
+-- corrupts every generated SQL const in the file. Keep this file pure ASCII.
+
+-- name: CreateLoginRequest :exec
+INSERT INTO login_requests (id, poll_secret, approval_code, status, new_device_name, new_device_type, user_agent, request_ip, created_at, expires_at)
+VALUES (?, ?, ?, 'pending', ?, ?, ?, ?, ?, ?);
+
+-- name: GetLoginRequest :one
+SELECT id, poll_secret, approval_code, status, new_device_name, new_device_type, user_agent, request_ip, approver_user_id, grant_scope, grant_persist, created_at, expires_at, approved_at
+FROM login_requests
+WHERE id = ?;
+
+-- ApproveLoginRequest flips pending -> approved and records who approved it plus
+-- the granted scope/persistence. execrows so the handler can tell whether it
+-- actually transitioned (0 = already consumed / denied / gone).
+-- name: ApproveLoginRequest :execrows
+UPDATE login_requests
+SET status = 'approved', approver_user_id = ?, grant_scope = ?, grant_persist = ?, approved_at = ?
+WHERE id = ? AND status = 'pending';
+
+-- name: DenyLoginRequest :execrows
+UPDATE login_requests
+SET status = 'denied'
+WHERE id = ? AND status = 'pending';
+
+-- ConsumeLoginRequest flips approved -> consumed when the new device collects its
+-- session, making the request single-use.
+-- name: ConsumeLoginRequest :execrows
+UPDATE login_requests
+SET status = 'consumed'
+WHERE id = ? AND status = 'approved';
+
+-- name: DeleteExpiredLoginRequests :execrows
+DELETE FROM login_requests
+WHERE expires_at < ?;

internal/db/queries/web_sessions.sql

@@ -9,7 +9,7 @@ INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, c
 VALUES (?, ?, ?, ?, ?, ?, ?, ?);
 
 -- name: GetWebSession :one
-SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at
+SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
 FROM web_sessions
 WHERE id = ?;
 
@@ -30,3 +30,33 @@ WHERE id = ?;
 -- name: DeleteExpiredWebSessions :execrows
 DELETE FROM web_sessions
 WHERE expires_at < ?;
+
+-- CreateSelfSession inserts a cdrop self-signed session (kind self/guest) that has
+-- no IdP refresh_token (stored empty): refresh mints a fresh access token straight
+-- from this row without touching the IdP. Used by QR scan-login (AUTH.md 4).
+-- name: CreateSelfSession :exec
+INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, kind, scope, granted_by, created_at, last_used_at, expires_at)
+VALUES (?, ?, '', ?, ?, ?, ?, ?, ?, ?, ?);
+
+-- SlideWebSession pushes a session's sliding window forward without rotating any
+-- token. Self/guest sessions use it on refresh (they have no refresh_token to
+-- rotate); oidc sessions keep using RotateWebSession.
+-- name: SlideWebSession :exec
+UPDATE web_sessions
+SET last_used_at = ?, expires_at = ?
+WHERE id = ?;
+
+-- ListWebSessionsByUser lists a user's sessions for the management UI (revoke
+-- borrowed / guest devices). granted_by ties a scan-approved session to its
+-- approver for cascade revocation.
+-- name: ListWebSessionsByUser :many
+SELECT id, user_id, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
+FROM web_sessions
+WHERE user_id = ?
+ORDER BY last_used_at DESC;
+
+-- DeleteWebSessionForUser drops one session scoped to its owner, so a user can
+-- only revoke their own.
+-- name: DeleteWebSessionForUser :execrows
+DELETE FROM web_sessions
+WHERE id = ? AND user_id = ?;