feat(auth): 重构认证系统，引入 session 会话管理

- 新增 user_sessions 数据库表及 Alembic 迁移
- 实现 SessionService 会话生命周期管理（创建/刷新/撤销/清理）
- 认证流程改用 refresh token cookie + access token 双令牌模式
- 前端实现自动静默刷新、跨标签页同步及设备指纹
- 用户设置页新增会话管理和密码修改功能
- 管理员用户管理新增强制登出和会话查看
- 密码策略增强，支持强度校验和泄露检测
- OAuth 登录流程适配新会话机制
- 新增完整的单元测试和 API 测试覆盖

Closes #232

Co-authored-by: LewisPen <LewisPen@nyadoo.com>

tests/unit/test_password_policy.py

@@ -1,6 +1,8 @@
 import pytest
+from pydantic import ValidationError
 
 from src.core.validators import PasswordPolicyLevel, PasswordValidator
+from src.models.api import LoginRequest
 
 
 class TestPasswordPolicy:
@@ -52,3 +54,28 @@ class TestPasswordPolicy:
 
         assert valid is True
         assert error is None
+
+    def test_rejects_password_longer_than_72_bytes(self) -> None:
+        valid, error = PasswordValidator.validate("a" * 80)
+
+        assert valid is False
+        assert error == "密码长度不能超过72字节"
+
+    def test_rejects_multibyte_password_longer_than_72_bytes(self) -> None:
+        valid, error = PasswordValidator.validate("中" * 25)
+
+        assert valid is False
+        assert error == "密码长度不能超过72字节"
+
+    def test_login_request_preserves_leading_and_trailing_spaces(self) -> None:
+        request = LoginRequest.model_validate(
+            {"email": "tester", "password": "  pass word  ", "auth_type": "local"}
+        )
+
+        assert request.password == "  pass word  "
+
+    def test_login_request_rejects_password_longer_than_72_bytes(self) -> None:
+        with pytest.raises(ValidationError, match="密码长度不能超过72字节"):
+            LoginRequest.model_validate(
+                {"email": "tester", "password": "a" * 80, "auth_type": "local"}
+            )