fix(server): devices 唯一键改 (user_id,uuid) —— 同机换账号不再 403 死结(F3,#27)

device_id 按安装持久、跨账号复用;旧全局 UNIQUE(uuid) 使同机第二账号注册永远
403 → ConnectNode 判 DEVICE_NOT_REGISTERED,提示的「重新登录」无法自救。

- migration 21(sqlite/mysql):UNIQUE(uuid)→UNIQUE(user_id,uuid);platform 放行
  linux(normalizePlatform 早已接受,旧 CHECK/ENUM 会拒)。SQLite 表重建用
  rename→重建→复制→drop 次序,单事务内不触发 sessions 的级联清空(FK ON)。
- 查找全部收口为按 (user,uuid) 作用域(重复 uuid 跨用户后全局查询歧义):
  findDeviceByUserUUIDTx / FindByUserUUID;Register 删跨用户 Forbidden 分支;
  Delete/ForceLogout/Rename 对他人设备返回 404(不可见);SessionActive 删
  「非本人 fail-safe」分支,dev==nil→false 语义不变。
- 测试:SQLite 真迁移库 F3 回归(两账号同 uuid 各自成行/同用户重复拒/linux 入库/
  sessions 重建后级联仍成立)+ MySQL 集成测试 schema 同步与双账号用例。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/devices/store.go

@@ -77,21 +77,24 @@ func (s *Store) ListByUser(ctx context.Context, userID int64) ([]DeviceRow, erro
 	return out, rows.Err()
 }
 
-// findDeviceByUUIDTx looks up a device by UUID with FOR UPDATE inside tx.
-// Returns (nil, nil) when the device does not exist.
-func (s *Store) findDeviceByUUIDTx(ctx context.Context, tx *sql.Tx, uuid string) (*DeviceRow, error) {
+// findDeviceByUserUUIDTx looks up the user's device by UUID with FOR UPDATE
+// inside tx. Returns (nil, nil) when the device does not exist for this user.
+// 必须带 user_id:唯一键是 UNIQUE(user_id,uuid)(migration 21),同一物理设备的
+// uuid 可在多个账号下各有一行,全局按 uuid 查会歧义。
+func (s *Store) findDeviceByUserUUIDTx(ctx context.Context, tx *sql.Tx, userID int64, uuid string) (*DeviceRow, error) {
 	row := tx.QueryRowContext(ctx,
 		`SELECT id, uuid, user_id, name, platform, last_seen, created_at, client_version, dp_uuid
-		 FROM devices WHERE uuid=? `+s.dialect.LockForUpdate(), uuid)
+		 FROM devices WHERE user_id=? AND uuid=? `+s.dialect.LockForUpdate(), userID, uuid)
 	return scanDeviceRow(row)
 }
 
-// FindByUUID looks up a device by UUID (non-tx). Returns (nil, nil) if absent.
-// Used by force-logout/delete to resolve ownership + dp_uuid.
-func (s *Store) FindByUUID(ctx context.Context, uuid string) (*DeviceRow, error) {
+// FindByUserUUID looks up the user's device by UUID (non-tx). Returns (nil, nil)
+// if absent for this user. Used by force-logout/delete/rename/session-poll to
+// resolve the device row; other users' rows with the same uuid are invisible.
+func (s *Store) FindByUserUUID(ctx context.Context, userID int64, uuid string) (*DeviceRow, error) {
 	row := s.db.QueryRowContext(ctx,
 		`SELECT id, uuid, user_id, name, platform, last_seen, created_at, client_version, dp_uuid
-		 FROM devices WHERE uuid=?`, uuid)
+		 FROM devices WHERE user_id=? AND uuid=?`, userID, uuid)
 	return scanDeviceRow(row)
 }