自主注册、登录、退出、当前用户与密码修改

兼容现有 PBKDF2 密码和 hz_session Cookie
TOTP 绑定、二步登录、防重放、恢复码与 AES-GCM 密钥
与 Node 完全一致的 Redis 键格式，可跨运行时共享会话
生产环境开启原生认证时强制要求 Redis
默认保持兼容代理；设置 AUTH_NATIVE_ENABLED=true 即可切换

src/Eis.Web/Program.cs

@@ -1,10 +1,12 @@
 using System.Net;
+using Eis.Infrastructure.Authentication;
 using Eis.Application.Public;
 using Eis.Infrastructure;
 using Eis.Infrastructure.Data;
 using Eis.Infrastructure.Migration;
 using Eis.Infrastructure.Security;
 using Eis.Web.Configuration;
+using Eis.Web.Authentication;
 using Eis.Web.Frontend;
 using Eis.Web.Legacy;
 using Eis.Web.Public;
@@ -29,11 +31,16 @@ builder.Services.AddHttpClient<LegacyApiProxy>((services, client) =>
 });
 builder.Services.AddProblemDetails();
 builder.Services.AddSingleton<IPublicSiteConfiguration, PublicSiteConfiguration>();
+var authenticationOptions = AuthenticationOptions.FromEnvironment(
+    builder.Environment.IsProduction(),
+    builder.Configuration.GetValue<bool>("AuthenticationMigration:NativeEnabled"));
 builder.Services.AddEisInfrastructure(
     DatabaseOptions.FromEnvironment(applicationRoot, builder.Environment.IsProduction()),
-    DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()));
+    DocumentVerificationOptions.FromEnvironment(builder.Environment.IsProduction()),
+    authenticationOptions);
 
 var app = builder.Build();
+app.Services.EnsureNativeAuthenticationReady(authenticationOptions);
 
 app.UseExceptionHandler();
 app.Use(async (context, next) =>
@@ -59,11 +66,18 @@ app.MapGet("/health/migration", async (LegacyApiProxy proxy, CancellationToken c
     {
         status = legacyAvailable ? "healthy" : "degraded",
         legacyApiAvailable = legacyAvailable,
-        features = MigrationFeatureCatalog.Current
+        authentication = new
+        {
+            nativeEnabled = authenticationOptions.NativeEnabled,
+            stateBackend = authenticationOptions.UsesRedis ? "redis" : "memory",
+            sharesLegacySessions = authenticationOptions.SharesLegacySessions
+        },
+        features = MigrationFeatureCatalog.Current(authenticationOptions.NativeEnabled)
     }, statusCode: statusCode);
 });
 
 app.MapNativePublicEndpoints();
+app.MapNativeAuthenticationEndpoints(authenticationOptions);
 
 string[] methods =
 [