fix(auth): 账号ID/登录名/昵称/微信身份彻底独立, 不再互相影响

- username 登录名独立生成: 微信用户 wx_<tokenHex>、手机号用户 u_<tokenHex> —— 不再 = openid / 手机号
- 手机号登录只按 phone 列查找(find_by_phone), 删除用 username 兜底
- 微信 openid/unionid/mini_openid 存各自列, 不污染 username

app/api/routers/auth.py

@@ -490,11 +490,12 @@ async def phone_login(req: PhoneLoginRequest, request: Request, db: Database = D
     except sms.SmsError as exc:
         raise HTTPException(status_code=401, detail=str(exc))
 
-    # 手机号唯一：既按「登录名=手机号」查，也按「已绑定手机」查（微信等身份绑了手机的用户）。
-    user = await db.users.find_by_phone(req.phone) or await db.users.get_by_username(req.phone)
+    # 手机号唯一：只按「已绑定手机 phone 列」查（登录名 username 与手机号是独立概念，不互查）。
+    user = await db.users.find_by_phone(req.phone)
     if user is None:
+        # 登录名独立生成（不=手机号），手机号存入 phone 列；用户以短信码登录。
         user = await db.users.create(
-            req.phone, password=secrets.token_hex(16),
+            f"u_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             phone=req.phone, role="opc_member",
             source=_client_source(request, getattr(req, "source", ""), "phone"),
             auth_type="phone", register_ip=_client_ip(request),
@@ -531,7 +532,7 @@ async def wx_login(req: WxLoginRequest, request: Request, db: Database = Depends
         user = await db.users.get_by_wx_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_openid=openid if not is_mini else "",
             wx_mini_openid=openid if is_mini else "",
             nickname=str(getattr(req, "nickName", "") or ""),
@@ -657,7 +658,7 @@ async def _find_or_create_wx_user(
     user = await db.users.get_by_wx_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_openid=openid, nickname="微信用户",
             role="opc_member",
             source=_client_source(request, "", "wx_openid"), auth_type="wx_openid",
@@ -839,7 +840,7 @@ async def mp_qr_confirm(request: Request, req: MpQrConfirmRequest, db: Database
     user = await db.users.get_by_wx_mini_openid(openid)
     if user is None:
         user = await db.users.create(
-            f"wx_{openid[:24]}", password=secrets.token_hex(16),
+            f"wx_{secrets.token_hex(10)}", password=secrets.token_hex(16),
             wx_mini_openid=openid, nickname="微信小程序用户",
             role="opc_member", source="mini_program", auth_type="wx_openid",
             register_ip=_client_ip(request),