自主注册、登录、退出、当前用户与密码修改

兼容现有 PBKDF2 密码和 hz_session Cookie
TOTP 绑定、二步登录、防重放、恢复码与 AES-GCM 密钥
与 Node 完全一致的 Redis 键格式，可跨运行时共享会话
生产环境开启原生认证时强制要求 Redis
默认保持兼容代理；设置 AUTH_NATIVE_ENABLED=true 即可切换

tests/helpers/current-totp-code.mjs

@@ -0,0 +1,5 @@
+import { totpAtStep } from '../../src/security/totp.mjs';
+
+const secret = String(process.argv[2] || '');
+if (!secret) throw new Error('TOTP secret is required');
+console.log(totpAtStep(secret, Math.floor(Date.now() / 1000 / 30)));

tests/helpers/enable-self-registration.mjs

@@ -0,0 +1,8 @@
+import { DatabaseSync } from 'node:sqlite';
+
+const databasePath = process.argv[2];
+if (!databasePath) throw new Error('缺少 SQLite 测试数据库路径');
+
+const database = new DatabaseSync(databasePath);
+database.prepare('UPDATE schema_metadata SET self_registration_enabled = 1 WHERE id = 1').run();
+database.close();