feat(server): SSO 换票端点(App→Web 免登握手)

/v1/auth/web-ticket(需登录):签发一次性票据(crypto/rand 32B, Redis GETDEL 单用, 60s)。
/v1/auth/web-ticket/exchange(公开):票换与 /auth/login 同款 token pair。镜像 jiu。含 6 测试。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

server/internal/auth/errors.go

@@ -83,4 +83,13 @@ var (
 		MessageZH: "服务器内部错误，请稍后重试",
 		MessageEn: "Internal server error, please try again later",
 	}
+
+	// ErrTicketInvalid — the web-ticket (App→网页免登录一次性票据) is missing,
+	// already used, or expired. Intentionally generic (mirrors ErrCodeInvalid) so
+	// the three cases can't be distinguished from the response.
+	ErrTicketInvalid = &apierr.Error{
+		Code:      "auth.ticket_invalid",
+		MessageZH: "登录票据无效或已过期，请重新从 App 打开",
+		MessageEn: "Login ticket is invalid or expired, please reopen from the app",
+	}
 )