cdrop — 跨 OS 剪贴板与文件传输服务

Commilitia Drop：自托管的跨设备剪贴板同步与点对点文件传输。

- 后端 Go（chi / SQLite WAL / SSE Hub / WebRTC signaling + 状态机 / Relay ring buffer），编译进单个 distroless 镜像（前端 go:embed）。
- 前端 React + TanStack Router + Zustand，自实现 SSE + WebRTC P2P，NAT 受阻时回退服务端中继；聚珍（Juzhen）CJK 综合排版。
- 桌面端 Wails v2（macOS / Windows），瘦客户端复用 web。
- 鉴权 OIDC PKCE（自建 Casdoor 等），refresh_token 信封加密存系统密钥库；iOS Shortcut 用 HS256 scoped token。

架构文档与变更记录见 docs 分支（PROJECT_BRIEF / FRONTEND_DESIGN / CHANGELOG）。

本次为公开发布初始提交：完整开发历史（含部署细节）留存于私有归档，公开仓库自此干净起步。

internal/db/queries/shortcut_tokens.sql

@@ -0,0 +1,32 @@
+-- shortcut_tokens: long-lived, scope-limited, revocable HS256 tokens for the
+-- iOS Shortcut clipboard sync. Count backs the per-user cap; Revoke is scoped by
+-- user_id to block cross-user revocation; Touch records last use asynchronously.
+
+-- name: InsertShortcutToken :exec
+INSERT INTO shortcut_tokens (jti, user_id, label, scopes, created_at, expires_at)
+VALUES (?, ?, ?, ?, ?, ?);
+
+-- name: GetShortcutToken :one
+SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
+FROM shortcut_tokens
+WHERE jti = ?;
+
+-- name: ListShortcutTokensByUser :many
+SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
+FROM shortcut_tokens
+WHERE user_id = ?
+ORDER BY created_at DESC;
+
+-- name: CountActiveShortcutTokensByUser :one
+SELECT COUNT(*) FROM shortcut_tokens
+WHERE user_id = ? AND revoked = 0 AND expires_at > ?;
+
+-- name: RevokeShortcutToken :execrows
+UPDATE shortcut_tokens
+SET revoked = 1
+WHERE jti = ? AND user_id = ?;
+
+-- name: TouchShortcutTokenUsed :exec
+UPDATE shortcut_tokens
+SET last_used_at = ?
+WHERE jti = ?;