feat(contracts): site center schemas, endpoints and migration 0031

Site health/proxy, SiteAccount login state (challenge, lastLoginAt, lastError,
userData), SiteUserData history table, SiteCredentialsBody by kind,
refresh-login/health-check/user-data/delete endpoints, SitesSettings defaults.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/instances.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { EntityBase, Id, JsonObject, SERVER_MANAGED, Timestamp } from "./common.ts";
+import { SiteCredentialsBody } from "./sources.ts";
 
 // 实例域:媒体库根、下载器实例、媒体服务器实例、路径映射(REQ §7.1、§8.4、§12.5)
 // 凭证只以 secretRef 暴露;创建/更新时的 credential 是只写明文,服务端加密为 secret 后丢弃。
@@ -170,24 +171,28 @@ export const InstanceTestResult = z.object({
 export type InstanceTestResult = z.infer<typeof InstanceTestResult>;
 
 /**
- * PUT /sites/{id}/credentials:站点账号凭证录入(cookie / passkey / apiKey / 密码)。
- * 按 (siteId, label) 建立或更新 site_account;明文加密为 secret 后丢弃,响应不回显。
+ * @deprecated 旧格式 {authKind, credential, username?};新客户端用 SiteCredentialsBody({kind, ...})。
+ * 服务端两种都接受,旧格式按 kind 转换。
  */
-export const SiteCredentialsPut = z.object({
+export const SiteCredentialsLegacyPut = z.object({
   label: z.string().min(1).max(80).default("default"),
   authKind: z.enum(["cookie", "passkey", "api_key", "password"]),
   /** 只写明文 */
   credential: Credential,
-  /** authKind=password 时的登录名(存入 user_info.username) */
+  /** authKind=password 时的登录名 */
   username: z.string().max(200).optional(),
   enabled: z.boolean().optional(),
 });
+export type SiteCredentialsLegacyPut = z.infer<typeof SiteCredentialsLegacyPut>;
+/** PUT /sites/{id}/credentials 请求体:新格式(按 kind 判别)或旧格式 */
+export const SiteCredentialsPut = z.union([SiteCredentialsBody, SiteCredentialsLegacyPut]);
 export type SiteCredentialsPut = z.infer<typeof SiteCredentialsPut>;
 export const SiteCredentialsResult = z.object({
   siteAccountId: Id,
   siteId: Id,
   label: z.string(),
   authKind: z.string(),
+  /** 本次写入的 secret 引用(passkey 请求时为 passkey 的引用) */
   secretRef: Id,
   /** true:新建账号;false:替换已有凭证 */
   created: z.boolean(),