Add candidate account archiving and password reset

src/routes/auth.routes.mjs

@@ -85,7 +85,7 @@ export function createAuthRoutes(context) {
       const db = await readDb();
       const account = cleanText(body.username, 120).toLowerCase();
       const user = db.users.find(item => item.username.toLowerCase() === account || String(item.candidateNumber || '').toLowerCase() === account);
-      if (!user || user.active === false || !verifyPassword(String(body.password || ''), user.passwordHash)) return sendError(response, 401, '账号或密码不正确');
+      if (!user || user.active === false || user.archivedAt || !verifyPassword(String(body.password || ''), user.passwordHash)) return sendError(response, 401, '账号或密码不正确');
       const token = randomBytes(32).toString('hex');
       sessions.set(token, { userId: user.id, expiresAt: Date.now() + 8 * 60 * 60 * 1000 });
       return sendJson(response, 200, { ok: true, user: safeUser(user) }, { 'Set-Cookie': `hz_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=28800` });
@@ -98,7 +98,7 @@ export function createAuthRoutes(context) {
       const newPassword = String(body.newPassword || '');
       if (!verifyPassword(currentPassword, user.passwordHash)) return sendError(response, 400, '当前密码不正确');
       if (newPassword.length < 8) return sendError(response, 400, '新密码至少需要 8 位');
-      if (newPassword === currentPassword) return sendError(response, 400, '新密码不能与初始密码相同');
+      if (newPassword === currentPassword) return sendError(response, 400, '新密码不能与当前密码相同');
       user.passwordHash = hashPassword(newPassword);
       user.mustChangePassword = false;
       const db = await readDb();