feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]

backend/src/MoShiro.Backend.Api/Admin/TrustEndpoints.cs

@@ -22,10 +22,9 @@ public static class TrustEndpoints
             .Returns<TrustStateDto>().ProducesProblems(401, 403)
             .Requires(Capability.FleetRead);
         guarded.MapPost("/trust", CommitAsync)
-            .Api("trust_commit", "Store the next operator set, signed with a passkey (the first one sets the genesis and needs a credential window)", Tag)
+            .Api("trust_commit", "Store the next operator set, signed with a passkey (the first one sets the genesis)", Tag)
             .Returns<TrustStateDto>(StatusCodes.Status201Created).ProducesProblems(400, 401, 403, 409)
-            .Requires(Capability.AccountsManage)
-            .ElevationExempt();
+            .Requires(Capability.AccountsManage);
     }
 
     private static async Task<IResult> StateAsync(HttpContext http, TrustService trust, ReleaseService releases, BackendOptions options)
@@ -60,12 +59,6 @@ public static class TrustEndpoints
     private static async Task<IResult> CommitAsync(HttpContext http, SignedStatementDto signed, TrustService trust, AgentService agents, BackendOptions options)
     {
         PasskeyContext context = AuthEndpoints.PasskeyContextOf(http, options);
-        // 第一次（创世）是整个信任根的起点：除了 passkey 签名，还要凭证窗口，避免只拿到一个密码会话的人抢先立根
-        if ((await trust.StateAsync(context, http.RequestAborted)).Initialized is false && ElevationGate.Require(http, ElevationClass.Credential, consume: true) is { } needed)
-        {
-            return needed;
-        }
-
         Result<TrustState> result = await trust.CommitAsync(signed, context, http.RequestAborted);
         if (!result.TryGet(out TrustState? state, out FleetError? error))
         {