feat(server): 设备上限登录闸(超限非硬拒登,返回 device_limit 信号)#16

启用设备数量限制的服务端部分。登录照常成功签发 token(非硬拒登),但若账户活跃
设备数超套餐上限,登录响应带 device_limit 信号,客户端据此弹「移除设备」页。

- devices/store.go:CountActiveDevices(last_seen 近 staleWindow)+ PruneStaleDevices
  (删超期僵尸行,免费版重装 churn 自愈)
- devices/service.go:staleWindow=30d;DeviceLimitStatus + CheckDeviceLimit
  (best-effort prune → ResolvePlan → 活跃 count > cap 即 Over,附活跃设备列表)
- auth:DeviceRegistrar 加 CheckDeviceLimit;recordLogin 回传 *DeviceLimit;
  LoginOutcome.DeviceLimit;Login 透传;handler tokenPairResponse.device_limit(omitempty)
- main.go:authDeviceRegistrar 适配 devices.CheckDeviceLimit → auth.DeviceLimit
- 测试:auth 登录透传超限信号(仍签发 token);devices within/over/prune-stale

连接侧 backstop(服务端硬拦)本轮从简未做,作为后续硬化(登录闸为客户端可信信号)。
DB 无 schema 变更。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/auth/device_register_test.go

@@ -13,6 +13,8 @@ type fakeRegistrar struct {
 	}
 	deviceID int64
 	err      error
+	limit    *DeviceLimit // returned by CheckDeviceLimit (nil = within cap)
+	limitErr error
 }
 
 func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta DeviceMeta) (int64, error) {
@@ -23,6 +25,10 @@ func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta Dev
 	return f.deviceID, f.err
 }
 
+func (f *fakeRegistrar) CheckDeviceLimit(_ context.Context, _ int64) (*DeviceLimit, error) {
+	return f.limit, f.limitErr
+}
+
 // Register/Login with a device should trigger RegisterDevice with the meta.
 func TestService_RegisterDevice_OnRegisterAndLogin(t *testing.T) {
 	svc, _, _ := newService(t, ServiceConfig{})
@@ -55,6 +61,39 @@ func TestService_RegisterDevice_OnRegisterAndLogin(t *testing.T) {
 	}
 }
 
+// Login surfaces the registrar's over-limit signal (non-hard-reject: tokens still
+// issued, DeviceLimit attached for the client to present "remove a device" UX).
+func TestService_Login_SurfacesDeviceLimit(t *testing.T) {
+	svc, _, _ := newService(t, ServiceConfig{})
+	last := "2026-07-01T00:00:00Z"
+	reg := &fakeRegistrar{limit: &DeviceLimit{
+		MaxDevices: 1,
+		Devices:    []DeviceBrief{{UUID: "old", Name: "Old Phone", Platform: "android", LastSeen: &last}},
+	}}
+	svc.SetDeviceRegistrar(reg)
+	ctx := context.Background()
+	const email = "lim@example.com"
+	const pw = "supersecret"
+	meta := DeviceMeta{DeviceID: "new-dev", Platform: "ios"}
+	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
+		t.Fatalf("SendCode: %v", err)
+	}
+	code := codeInRedis(t, svc, email)
+	if _, e := svc.Register(ctx, email, code, pw, "", meta); e != nil {
+		t.Fatalf("Register: %v", e)
+	}
+	out, _, e := svc.Login(ctx, email, pw, "", meta)
+	if e != nil {
+		t.Fatalf("Login must succeed (non-hard-reject): %v", e)
+	}
+	if out.Tokens == nil {
+		t.Fatalf("login should still issue tokens")
+	}
+	if out.DeviceLimit == nil || out.DeviceLimit.MaxDevices != 1 || len(out.DeviceLimit.Devices) != 1 {
+		t.Fatalf("expected device_limit surfaced, got %+v", out.DeviceLimit)
+	}
+}
+
 // A registrar error (e.g. device cap) must NOT fail login/register.
 func TestService_RegisterDevice_BestEffort(t *testing.T) {
 	svc, _, _ := newService(t, ServiceConfig{})