[mahoshojoHCG]

设置新增对所有登录角色开放的「账户安全」，支持添加 Passkey，并在新的 Passkey 验证后删除密码；登录和敏感操作重新认证均支持无密码账户。客户端及服务端仅允许 HTTPS，公共登录选项统一使用可发现凭据，不暴露账户的凭据 ID 或数量；账户禁用竞态正常返回 401。

使用 Fido2 4.1.0 校验 WebAuthn，公钥与五分钟一次性挑战存入 PostgreSQL。挑战绑定来源、用途、账户、会话和浏览器；删除密码撤销其他会话并禁用旧 bootstrap 密码回退，账户行锁保护并发密码认证。外观、播放偏好和账户安全三个个人设置入口保留各自权限与三语文案，开发 mock 不模拟密码学验证。

迁移快照及最新迁移目标模型同时保留档案头像和 Passkeys。交互重新认证及认证语言包按需加载，维持身份绑定和取消处理，避免整合功能后首页超出已有体积预算。修正现有 E2E 的登录按钮精确匹配。

验证：

• 完整 solution build 通过；有一个既有 RS2008 warning。
• 现有认证/账户单测 16/16、认证与角色集成 15/15、PostgreSQL household migration 8/8 通过；EF 模型无待迁移变化。
• Yarn immutable install、typecheck、完整 format:check、单测 34/34、E2E 6/6、build:budget 通过。
• 首页 795,647 / 800,000 字节，未提高预算。
• 认证懒加载入口、身份检查与取消处理完成独立复核；未新增测试或回归检查。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T16:47:51.431468Z	85bc54d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85bc54d5dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".