开源前加固认证与部署契约：加密随机 JWT、改密事务吊销、登录 CSRF，并禁止生产回落 localhost。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/service/operations_maintenance.go

@@ -38,7 +38,14 @@ func (o *Operations) ResetPassword(email, code, password string) error {
 		if len(users) != 1 {
 			return errors.New("账号不可用")
 		}
-		return tx.Model(&model.User{}).Where("id = ?", users[0].ID).Updates(map[string]any{"password": string(hash), "token_version": gorm.Expr("token_version + 1")}).Error
+		if e := tx.Model(&model.User{}).Where("id = ?", users[0].ID).Updates(map[string]any{
+			"password":      string(hash),
+			"token_version": gorm.Expr("token_version + 1"),
+		}).Error; e != nil {
+			return e
+		}
+		return tx.Model(&model.RefreshToken{}).Where("user_id = ? AND revoked = ?", users[0].ID, false).
+			Updates(map[string]any{"revoked": true, "token_cipher": ""}).Error
 	})
 }
 func (o *Operations) Diagnostics(ctx context.Context) map[string]any {