feat(auth): 重构认证系统，引入 session 会话管理

- 新增 user_sessions 数据库表及 Alembic 迁移
- 实现 SessionService 会话生命周期管理（创建/刷新/撤销/清理）
- 认证流程改用 refresh token cookie + access token 双令牌模式
- 前端实现自动静默刷新、跨标签页同步及设备指纹
- 用户设置页新增会话管理和密码修改功能
- 管理员用户管理新增强制登出和会话查看
- 密码策略增强，支持强度校验和泄露检测
- OAuth 登录流程适配新会话机制
- 新增完整的单元测试和 API 测试覆盖

Closes #232

Co-authored-by: LewisPen <LewisPen@nyadoo.com>

tests/unit/test_user_me_password.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from contextlib import contextmanager
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from src.api.user_me.routes import _change_password_sync
+from src.core.exceptions import InvalidRequestException
+from src.core.validators import PasswordPolicyLevel
+from src.models.database import User
+
+
+def test_verify_password_returns_false_for_password_over_72_bytes() -> None:
+    user = User(email=None, email_verified=False, username="tester")
+    user.set_password("abc12345")
+
+    assert user.verify_password("a" * 80) is False
+
+
+def test_change_password_rejects_same_as_current_password(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    user = SimpleNamespace(
+        id="user-1",
+        email="user@example.com",
+        password_hash="hashed",
+        auth_source=SimpleNamespace(value="local"),
+        verify_password=MagicMock(side_effect=lambda password: password == "Abcd1234!"),
+        set_password=MagicMock(),
+        updated_at=None,
+    )
+
+    db = MagicMock()
+    db.query.return_value.filter.return_value.first.return_value = user
+
+    @contextmanager
+    def _fake_get_db_context() -> MagicMock:
+        yield db
+
+    monkeypatch.setattr("src.api.user_me.routes.get_db_context", _fake_get_db_context)
+    monkeypatch.setattr(
+        "src.api.user_me.routes.SystemConfigService.get_password_policy_level",
+        lambda _db: PasswordPolicyLevel.STRONG.value,
+    )
+
+    with pytest.raises(InvalidRequestException, match="新密码不能与当前密码相同"):
+        _change_password_sync(
+            "user-1",
+            SimpleNamespace(old_password="Abcd1234!", new_password="Abcd1234!"),
+        )
+
+    user.set_password.assert_not_called()