cdrop — 跨 OS 剪贴板与文件传输服务

Commilitia Drop：自托管的跨设备剪贴板同步与点对点文件传输。

- 后端 Go（chi / SQLite WAL / SSE Hub / WebRTC signaling + 状态机 / Relay ring buffer），编译进单个 distroless 镜像（前端 go:embed）。
- 前端 React + TanStack Router + Zustand，自实现 SSE + WebRTC P2P，NAT 受阻时回退服务端中继；聚珍（Juzhen）CJK 综合排版。
- 桌面端 Wails v2（macOS / Windows），瘦客户端复用 web。
- 鉴权 OIDC PKCE（自建 Casdoor 等），refresh_token 信封加密存系统密钥库；iOS Shortcut 用 HS256 scoped token。

架构文档与变更记录见 docs 分支（PROJECT_BRIEF / FRONTEND_DESIGN / CHANGELOG）。

本次为公开发布初始提交：完整开发历史（含部署细节）留存于私有归档，公开仓库自此干净起步。

internal/jwtauth/devices.go

@@ -0,0 +1,38 @@
+package jwtauth
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"commilitia.net/cdrop/internal/db"
+)
+
+// DeviceSweepInterval is how often the device sweeper wakes up.
+const DeviceSweepInterval = 1 * time.Hour
+
+// RunDeviceSweeper deletes devices whose last_seen is older than ttl.
+// Per user requirement: device registration must not outlive the longest
+// valid refresh_token (brief §2: 196h sliding window). Anything ≤ TTL is fine;
+// 0 disables the sweeper.
+func RunDeviceSweeper(ctx context.Context, queries *db.Queries, ttl time.Duration) {
+	if ttl <= 0 {
+		slog.Info("device sweeper disabled (ttl <= 0)")
+		return
+	}
+	slog.Info("device sweeper running", "ttl", ttl, "interval", DeviceSweepInterval)
+
+	t := time.NewTicker(DeviceSweepInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			cutoff := time.Now().Add(-ttl).Unix()
+			if err := queries.DeleteStaleDevices(ctx, cutoff); err != nil {
+				slog.Error("device sweeper failed", "err", err)
+			}
+		}
+	}
+}