feat(backend): unified response helpers, refresh token, security hardening

- new resp package (OK/Page/Fail/BadRequest/.../InternalErr): unified error
  envelope {detail, code?}, sanitized 500s (full error logged server-side,
  generic message to client - stops DB error leakage), pagination envelope
  {items,total,page,page_size}; migrate 200+ inline c.JSON error sites
- refresh token: 7d rotation tokens (SHA-256 hashed at rest), public
  POST /auth/refresh with single-use rotation, POST /auth/logout revokes
  all user refresh tokens (endpoint previously missing - frontend 404)
- security: gh-ost command line password masked in task status payload;
  Instance.MarshalJSON guarantees encrypted passwords never leave the API
  (removes reliance on per-handler manual masking); production (DEBUG=false)
  with default JWT secret now auto-generates and persists a random secret
- safe.Go recover wrapper for background goroutines (instance probe,
  gh-ost async)
- delete dead service layer (zero callers)
- fix pre-existing go vet unkeyed bson.E literals

backend/internal/middleware/auth.go

@@ -1,6 +1,9 @@
 package middleware
 
 import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
 	"net/http"
 	"strconv"
 	"strings"
@@ -13,6 +16,71 @@ import (
 	"github.com/golang-jwt/jwt/v5"
 )
 
+// RefreshTokenTTL refresh token 有效期；access token 有效期仍走 session_timeout_hours
+const RefreshTokenTTL = 7 * 24 * time.Hour
+
+func hashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
+}
+
+// GenerateRefreshToken 签发 refresh token（明文只返回给客户端，库里只存 SHA-256 摘要）
+func GenerateRefreshToken(userID int) (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	token := hex.EncodeToString(buf)
+	rt := model.RefreshToken{
+		UserID:    userID,
+		TokenHash: hashToken(token),
+		ExpiresAt: time.Now().Add(RefreshTokenTTL),
+	}
+	if err := model.DB.Create(&rt).Error; err != nil {
+		return "", err
+	}
+	// 顺手清理该用户已过期/已撤销的记录
+	model.DB.Where("user_id = ? AND (expires_at < ? OR revoked_at IS NOT NULL)", userID, time.Now()).Delete(&model.RefreshToken{})
+	return token, nil
+}
+
+// ConsumeRefreshToken 校验并轮换 refresh token（旧 token 撤销、签发新对），返回所属用户与新 refresh token。
+func ConsumeRefreshToken(tokenStr string) (*model.User, string, error) {
+	var rt model.RefreshToken
+	if err := model.DB.Where("token_hash = ?", hashToken(tokenStr)).First(&rt).Error; err != nil {
+		return nil, "", err
+	}
+	if rt.RevokedAt != nil || rt.ExpiresAt.Before(time.Now()) {
+		return nil, "", ErrTokenRevoked
+	}
+
+	var user model.User
+	if err := model.DB.First(&user, rt.UserID).Error; err != nil {
+		return nil, "", err
+	}
+	if user.IsActive != nil && !*user.IsActive {
+		return nil, "", ErrTokenRevoked
+	}
+
+	now := time.Now()
+	rt.RevokedAt = &now
+	model.DB.Save(&rt)
+
+	newToken, err := GenerateRefreshToken(rt.UserID)
+	if err != nil {
+		return nil, "", err
+	}
+	return &user, newToken, nil
+}
+
+// RevokeUserRefreshTokens 撤销用户全部 refresh token（登出/改密时调用）
+func RevokeUserRefreshTokens(userID int) {
+	now := time.Now()
+	model.DB.Model(&model.RefreshToken{}).
+		Where("user_id = ? AND revoked_at IS NULL", userID).
+		Update("revoked_at", now)
+}
+
 // getSessionTimeoutHours reads session_timeout_hours from system_settings,
 // falls back to config/env, then default 24h.
 func getSessionTimeoutHours() int {
@@ -35,6 +103,13 @@ type Claims struct {
 	jwt.RegisteredClaims
 }
 
+// ErrTokenRevoked refresh token 已撤销/过期
+var ErrTokenRevoked = errTokenRevoked{}
+
+type errTokenRevoked struct{}
+
+func (errTokenRevoked) Error() string { return "refresh token revoked or expired" }
+
 func GenerateToken(user *model.User) (string, error) {
 	claims := Claims{
 		UserID:   user.ID,