feat(contracts): site center schemas, endpoints and migration 0031

Site health/proxy, SiteAccount login state (challenge, lastLoginAt, lastError,
userData), SiteUserData history table, SiteCredentialsBody by kind,
refresh-login/health-check/user-data/delete endpoints, SitesSettings defaults.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/test/db-sync.test.ts

@@ -76,8 +76,15 @@ const ROWS: Record<string, { row: Obj; dbOnly?: string[]; apiOnly?: string[] }>
   Secret: { row: C.Secret, dbOnly: ["ciphertext", "nonce", "authTag"] },
   ServerMapping: { row: C.ServerMapping },
   Settings: { row: C.SettingEntry },
-  Site: { row: C.Site },
-  SiteAccount: { row: C.SiteAccount },
+  // deleted_at:软删除只在服务端过滤(已删站点不出 API)
+  Site: { row: C.Site, dbOnly: ["deletedAt"] },
+  // secret 引用不外露,只给布尔
+  SiteUserData: { row: C.SiteUserData },
+  SiteAccount: {
+    row: C.SiteAccount,
+    dbOnly: ["totpSecretRef", "sessionSecretRef", "passkeySecretRef"],
+    apiOnly: ["hasTotp", "hasSession", "hasPasskey"],
+  },
   SourceRelease: { row: C.SourceRelease },
   Subscription: { row: C.Subscription, apiOnly: ["mediaEntityTitle"] },
   Task: { row: C.Task },