feat(auth): add WeChat mini program login endpoint

Add jscode2session exchange, CSRF bypass for servicewechat.com,
and openid-based auto register/login for the mini program client.

Co-authored-by: Cursor <cursoragent@cursor.com>

user-auth.mjs

@@ -2865,11 +2865,52 @@ export function createUserAuth(pool, options = {}) {
     return result;
   };
 
+  const loginByWechatMiniProgram = async ({
+    appId,
+    openid,
+    unionid,
+    now = Date.now(),
+  }) => {
+    const existing = await findWechatUserByOpenid(appId, openid);
+    if (existing) {
+      if (existing.status === 'disabled') {
+        return { ok: false, message: '账户已禁用，请联系管理员' };
+      }
+      return loginBoundWechatUser({
+        userId: existing.userId,
+        appId,
+        openid,
+        unionid,
+        nickname: existing.nickname,
+        avatarUrl: null,
+        now,
+      });
+    }
+
+    const registered = await registerViaWechat({
+      appId,
+      openid,
+      unionid,
+      nickname: '微信用户',
+      avatarUrl: null,
+      now,
+    });
+    if (!registered.ok) return registered;
+    const token = await issueUserSession(registered.user.id, registered.user.role, now);
+    return {
+      ok: true,
+      token,
+      user: registered.user,
+      isNewUser: true,
+    };
+  };
+
   return {
     USER_COOKIE,
     register,
     login,
     loginByWechat,
+    loginByWechatMiniProgram,
     resolveWechatAuth,
     completeWechatRegister,
     completeWechatBindAccount,