feat(login): lead with embedded Feishu/WeCom QR sign-in

[wxkingstar]

Summary

Scan-to-sign-in is now the primary entry on the login page; username/password is secondary.

• Feishu configured → the page opens on an embedded Feishu QR code ("飞书扫码登录"), a waiting status, a "使用飞书账号登录" button (existing web authorize flow, one click if the browser is already signed in to Feishu), and a "没有飞书？用账号密码登录" link.
• WeCom configured → same layout with the official WeCom login panel (ww.createWWLoginPanel) embedded.
• Both configured → a switch picks the platform; the choice is remembered per browser.
• Neither → only the password form (the disabled platform placeholders are gone).

How it works

• POST /api/auth/feishu/qr returns a passport.feishu.cn authorize URL. The page frames Feishu's QR page (what LarkSSOSDKWebQRCode does, without loading the third-party script), accepts the tmp_code message only from that frame and a feishu.cn origin, then navigates to goto&tmp_code=…. Feishu redirects to the existing /api/auth/feishu/callback with code/state.
• POST /api/auth/wecom/qr returns the panel params; @wecom/jssdk (lazy-loaded chunk, ~18 KB gzip, only when WeCom is configured) runs in callback mode and the page opens the existing /api/auth/wecom/callback.
• State creation is shared with /start. The QR is re-issued every 9 minutes (state TTL is 10).
• A browser now reuses its existing binding cookie, so several login tabs or the periodic refresh don't invalidate each other's state.
• Inside the Feishu/WeCom client the page still auto-starts the in-app login and no longer renders the card meanwhile, so no QR request races that redirect for the binding cookie.
• Icons: IconPark new-lark (Apache-2.0) and TDesign logo-wecom-filled (MIT), recolored, with NOTICE and license files in web/public/platforms/.

Test plan

• uv run ruff check ., uv run mypy coreman, uv run pytest (2988 passed)
• npm run lint, vue-tsc --noEmit, vitest run (318 passed), npm run build
• New API tests: QR endpoints return the right URL/params, sign in through the existing callback, a second QR request in the same browser keeps the first state valid, 404 when not configured
• New view tests: Feishu QR iframe src + tmp_code handling (ignores foreign frames/origins), password ↔ scan switching, WeCom panel callback, platform switch memory, no QR request during in-client auto-login
• Visually checked light/dark/mobile with a real Feishu QR frame; WeCom panel embeds (real corp needed to show a QR)
• Real scan on a deployment (Feishu, then WeCom)

🤖 Generated with Claude Code