施工(HEL-226): 实现登录门户与本机免密切换账号

用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

backend/database/migrations/__init__.py

@@ -2,6 +2,7 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
 from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
+from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
 from .runner import Migration, MigrationError, MigrationRunner
 
 MIGRATIONS = (
@@ -9,6 +10,7 @@ MIGRATIONS = (
     M0002_JOB_RUNS,
     M0003_LLM_AUDIT,
     M0004_MENTOR_NOTES,
+    M0005_ACCOUNT_SWITCH_GRANTS,
 )
 
 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]

backend/database/migrations/m0005_account_switch_grants.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+import sqlite3
+
+from backend.database.migrations.runner import Migration
+
+
+def create_account_switch_grants(connection: sqlite3.Connection) -> None:
+    connection.execute(
+        """
+        CREATE TABLE IF NOT EXISTS account_switch_grants (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            device_hash TEXT NOT NULL,
+            user_id INTEGER NOT NULL,
+            granted_at TEXT NOT NULL,
+            last_used_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            UNIQUE (device_hash, user_id),
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        )
+        """
+    )
+    connection.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
+        ON account_switch_grants(device_hash, last_used_at DESC)
+        """
+    )
+    connection.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
+        ON account_switch_grants(expires_at)
+        """
+    )
+
+
+MIGRATION = Migration(
+    version="0005",
+    name="create_account_switch_grants",
+    action=create_account_switch_grants,
+    signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
+)