自主注册、登录、退出、当前用户与密码修改

兼容现有 PBKDF2 密码和 hz_session Cookie
TOTP 绑定、二步登录、防重放、恢复码与 AES-GCM 密钥
与 Node 完全一致的 Redis 键格式，可跨运行时共享会话
生产环境开启原生认证时强制要求 Redis
默认保持兼容代理；设置 AUTH_NATIVE_ENABLED=true 即可切换

src/Eis.Application/Authentication/IAuthenticationService.cs

@@ -0,0 +1,57 @@
+using System.Text.Json.Nodes;
+
+namespace Eis.Application.Authentication;
+
+public sealed record AuthenticationEndpointResult(int StatusCode, JsonObject Body, string? SetCookie = null);
+
+public interface IAuthenticationService
+{
+    Task<AuthenticationEndpointResult> RegisterAsync(
+        string name,
+        string gender,
+        string password,
+        string schoolId,
+        string classId,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> GetCurrentUserAsync(string sessionToken, CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> LoginAsync(string username, string password, CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> CompleteTotpLoginAsync(
+        string challenge,
+        string code,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> ChangePasswordAsync(
+        string sessionToken,
+        string currentPassword,
+        string newPassword,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> GetTotpStatusAsync(string sessionToken, CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> BeginTotpSetupAsync(
+        string sessionToken,
+        string currentPassword,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> EnableTotpAsync(
+        string sessionToken,
+        string code,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> RegenerateRecoveryCodesAsync(
+        string sessionToken,
+        string currentPassword,
+        string code,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> DisableTotpAsync(
+        string sessionToken,
+        string currentPassword,
+        string code,
+        CancellationToken cancellationToken);
+
+    Task<AuthenticationEndpointResult> LogoutAsync(string sessionToken, CancellationToken cancellationToken);
+}