feat(M08-D): 补后台登录与可撤销会话

database/migrations/2026081004_m08d_admin_password_auth.up.sql

@@ -0,0 +1,28 @@
+CREATE TABLE IF NOT EXISTS qipai_admin_credentials (
+  id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+  tenant_id BIGINT UNSIGNED NOT NULL,
+  user_id BIGINT UNSIGNED NOT NULL,
+  login_name VARCHAR(64) NOT NULL,
+  password_hash VARCHAR(255) NOT NULL,
+  status VARCHAR(32) NOT NULL DEFAULT 'ACTIVE',
+  failed_attempts INT UNSIGNED NOT NULL DEFAULT 0,
+  locked_until DATETIME(3) NULL,
+  password_changed_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  last_login_at DATETIME(3) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  deleted_at DATETIME(3) NULL,
+  CONSTRAINT fk_qipai_admin_credentials_tenant FOREIGN KEY (tenant_id) REFERENCES qipai_tenants(id),
+  CONSTRAINT fk_qipai_admin_credentials_user FOREIGN KEY (user_id) REFERENCES qipai_users(id),
+  UNIQUE KEY uq_qipai_admin_credentials_login (tenant_id, login_name),
+  UNIQUE KEY uq_qipai_admin_credentials_user (tenant_id, user_id),
+  KEY idx_qipai_admin_credentials_status (tenant_id, status, locked_until)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+ALTER TABLE qipai_auth_sessions
+  ADD COLUMN refresh_token_hash CHAR(64) NULL AFTER role_version,
+  ADD COLUMN refresh_expires_at DATETIME(3) NULL AFTER expires_at,
+  ADD KEY idx_qipai_auth_sessions_refresh (status, refresh_expires_at);
+
+INSERT IGNORE INTO qipai_schema_migrations (version, name)
+VALUES ('2026081004', 'm08d_admin_password_auth');