feat(auth): 重构认证系统，引入 session 会话管理

- 新增 user_sessions 数据库表及 Alembic 迁移
- 实现 SessionService 会话生命周期管理（创建/刷新/撤销/清理）
- 认证流程改用 refresh token cookie + access token 双令牌模式
- 前端实现自动静默刷新、跨标签页同步及设备指纹
- 用户设置页新增会话管理和密码修改功能
- 管理员用户管理新增强制登出和会话查看
- 密码策略增强，支持强度校验和泄露检测
- OAuth 登录流程适配新会话机制
- 新增完整的单元测试和 API 测试覆盖

Closes #232

Co-authored-by: LewisPen <[email protected]>

tests/unit/test_config_auth_cookies.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+import pytest
+
+from src.config.settings import Config
+
+
+def test_production_defaults_refresh_cookie_to_cross_site(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ENVIRONMENT", "production")
+    monkeypatch.delenv("AUTH_REFRESH_COOKIE_SAMESITE", raising=False)
+    monkeypatch.delenv("AUTH_REFRESH_COOKIE_SECURE", raising=False)
+
+    cfg = Config()
+
+    assert cfg.auth_refresh_cookie_samesite == "none"
+    assert cfg.auth_refresh_cookie_secure is True
+
+
+def test_validate_security_config_rejects_insecure_none_cookie(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("ENVIRONMENT", "production")
+    monkeypatch.setenv("AUTH_REFRESH_COOKIE_SAMESITE", "none")
+    monkeypatch.setenv("AUTH_REFRESH_COOKIE_SECURE", "false")
+
+    cfg = Config()
+
+    assert (
+        "AUTH_REFRESH_COOKIE_SECURE must be true when AUTH_REFRESH_COOKIE_SAMESITE=none."
+        in cfg.validate_security_config()
+    )
+
+
+def test_validate_security_config_rejects_invalid_refresh_cookie_samesite(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("AUTH_REFRESH_COOKIE_SAMESITE", "invalid-value")
+
+    cfg = Config()
+
+    assert "AUTH_REFRESH_COOKIE_SAMESITE must be one of: lax, strict, none." in (
+        cfg.validate_security_config()
+    )