feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

backend/src/MoShiro.Backend.Application/Auth/AuthService.cs

@@ -71,7 +71,7 @@ public sealed partial class AuthService
         }
 
         UserRecord? user = await _store.GetUserAsync(session.UserId, ct);
-        return user is null ? null : new Principal(PrincipalKind.Session, Principal.SetOf(CapabilityCatalog.ForSession()), user.Id, user.Username, Base64Url.Encode(session.CsrfToken), null) { AuthMethod = session.AuthMethod, SessionId = Convert.ToHexString(session.IdSha256) };
+        return user is null ? null : new Principal(PrincipalKind.Session, Principal.SetOf(CapabilityCatalog.ForSession(session.AuthMethod)), user.Id, user.Username, Base64Url.Encode(session.CsrfToken), null) { AuthMethod = session.AuthMethod, SessionId = Convert.ToHexString(session.IdSha256) };
     }
 
     public async ValueTask<Principal?> AuthenticateTokenAsync(string bearer, CancellationToken ct)

backend/src/MoShiro.Backend.Application/Auth/Capabilities.cs

@@ -59,7 +59,7 @@ public static class CapabilityCatalog
 
         new(Capability.FleetRead, "fleet"),
         new(Capability.FleetWrite, "fleet", false, false, Capability.FleetRead),
-        new(Capability.FleetEnroll, "fleet", true, false, Capability.FleetRead),
+        new(Capability.FleetEnroll, "fleet", false, false, Capability.FleetRead),
         new(Capability.FleetRevoke, "fleet", true, false, Capability.FleetRead),
 
         new(Capability.TasksRead, "tasks"),
@@ -134,4 +134,10 @@ public static class CapabilityCatalog
 
     /// <summary>登录会话的能力：全部，包括信任类；信任类的操作还要有效的提权窗口（<see cref="ElevationService"/>）。</summary>
     public static IReadOnlyList<string> ForSession() => [.. All.Select(c => c.Id)];
+
+    /// <summary>
+    /// 按登录方式给会话能力：passkey 登录的拿全部；<b>密码登录的什么能力都没有</b>，只能做「已登录」就能做的事——
+    /// 看自己是谁、注册自己的第一个 passkey。管理员要先用密码进来加一个 passkey，之后用 passkey 登录才能管事。
+    /// </summary>
+    public static IReadOnlyList<string> ForSession(string authMethod) => authMethod == AuthMethods.Passkey ? ForSession() : [];
 }

backend/src/MoShiro.Backend.Application/Auth/ElevationService.cs

@@ -37,7 +37,6 @@ public static class Elevation
     /// <summary>端点要求的能力需要哪一种窗口；不是信任类的能力返回 null。</summary>
     public static ElevationClass? For(string capability) => capability switch
     {
-        Capability.FleetEnroll => ElevationClass.Enroll,
         Capability.FleetRevoke => ElevationClass.Revoke,
         Capability.AccountsManage => ElevationClass.Credential,
         _ => null,

backend/src/MoShiro.Backend.Application/Auth/ServerIdentityService.cs

@@ -0,0 +1,82 @@
+using System.Security.Cryptography;
+using Fleet.Identity;
+using Fleet.Server;
+
+namespace MoShiro.Backend.Application;
+
+/// <summary>
+/// 服务器的身份密钥（P-256）：操作员用 passkey 把公钥签进操作员集合，之后节点只认带这把密钥签名的服务器，
+/// 并在这条链路上用应用层加密（TLS 在 Cloudflare 或被冒充的证书那里终止时，中间人拿不出这把密钥）。
+/// 私钥存在 Backend 的设置里：它保护的是「面板被冒充」，不是「面板被攻破」；面板被攻破时它也会泄露，那时要由 passkey 签一个换掉它的新集合版本。
+/// </summary>
+public sealed class ServerIdentityService : IServerIdentity, IDisposable
+{
+    private const string Key = "server.identity_key";
+
+    private readonly ISettingsStore _settings;
+    private readonly object _gate = new();
+    private ECDsa? _key;
+    private byte[]? _spki;
+
+    public ServerIdentityService(ISettingsStore settings)
+    {
+        _settings = settings;
+    }
+
+    public byte[] PublicKeySpki
+    {
+        get
+        {
+            EnsureLoaded();
+            return _spki!;
+        }
+    }
+
+    /// <summary>公钥的指纹（SHA-256，小写十六进制）：页面上给人核对。</summary>
+    public string Fingerprint => Convert.ToHexStringLower(SHA256.HashData(PublicKeySpki));
+
+    public byte[] Sign(ReadOnlySpan<byte> payload)
+    {
+        EnsureLoaded();
+        return _key!.SignData(payload, HashAlgorithmName.SHA256, DSASignatureFormat.IeeeP1363FixedFieldConcatenation);
+    }
+
+    /// <summary>启动时调用：读出或生成密钥。节点可能在启动完成之前就连上来，所以 <see cref="Sign"/> 也会按需加载。</summary>
+    public ValueTask EnsureAsync(CancellationToken ct)
+    {
+        EnsureLoaded(ct);
+        return ValueTask.CompletedTask;
+    }
+
+    private void EnsureLoaded(CancellationToken ct = default)
+    {
+        if (_key is not null)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            if (_key is not null)
+            {
+                return;
+            }
+
+            string? stored = _settings.GetAsync(Key, ct).AsTask().GetAwaiter().GetResult();
+            var key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+            if (stored is not null)
+            {
+                key.ImportPkcs8PrivateKey(Convert.FromBase64String(stored), out _);
+            }
+            else
+            {
+                _settings.SetAsync(Key, Convert.ToBase64String(key.ExportPkcs8PrivateKey()), ct).AsTask().GetAwaiter().GetResult();
+            }
+
+            _spki = key.ExportSubjectPublicKeyInfo();
+            _key = key;
+        }
+    }
+
+    public void Dispose() => _key?.Dispose();
+}

backend/src/MoShiro.Backend.Application/Auth/TrustService.cs

@@ -11,7 +11,8 @@ namespace MoShiro.Backend.Application;
 public sealed record TrustProposal(string Statement, int Version, string Challenge);
 
 /// <summary><c>InSync</c>：当前生效的集合和现有的 passkey、域名是否一致；不一致就需要签一个新版本。</summary>
-public sealed record TrustState(bool Initialized, string? Genesis, int Version, bool InSync, IReadOnlyList<SignedStatementDto> Chain, TrustProposal? Proposal);
+/// <param name="ServerKey">这个面板的服务器身份密钥的指纹；<c>ServerKeyListed</c>：当前生效的操作员集合里已经登记了它（节点据此认证服务器、加密链路）。</param>
+public sealed record TrustState(bool Initialized, string? Genesis, int Version, bool InSync, IReadOnlyList<SignedStatementDto> Chain, TrustProposal? Proposal, IReadOnlyList<string>? Operators = null, string ServerKey = "", bool ServerKeyListed = false);
 
 /// <summary>
 /// 信任根的 Backend 一侧：保存操作员集合的链、给操作员出下一版的语句、验证他签回来的版本。
@@ -22,11 +23,13 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
 {
     private readonly IOperatorSetStore _store;
     private readonly IAuthStore _auth;
+    private readonly ServerIdentityService _server;
     private readonly TimeProvider _time;
     private readonly SemaphoreSlim _gate = new(1, 1);
 
-    public TrustService(IOperatorSetStore store, IAuthStore auth, TimeProvider time)
+    public TrustService(IOperatorSetStore store, IAuthStore auth, ServerIdentityService server, TimeProvider time)
     {
+        _server = server;
         _store = store;
         _auth = auth;
         _time = time;
@@ -50,7 +53,7 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
         TrustProposal? proposal = await ProposeAsync(chain, current, context, ct);
         OperatorSet? proposed = proposal is null ? null : OperatorTrust.ParseSet(proposal.Statement);
         bool inSync = current is not null && proposed is not null && Same(current, proposed);
-        return new TrustState(current is not null, chain.Count == 0 ? null : OperatorTrust.Fingerprint(chain[0].Statement), current?.Version ?? 0, inSync, chain, inSync ? null : proposal);
+        return new TrustState(current is not null, chain.Count == 0 ? null : OperatorTrust.Fingerprint(chain[0].Statement), current?.Version ?? 0, inSync, chain, inSync ? null : proposal, current is null ? [] : [.. current.Keys.Select(k => k.CredentialId)], _server.Fingerprint, current?.Servers?.Any(k => k.AsSpan().SequenceEqual(_server.PublicKeySpki)) == true);
     }
 
     private async ValueTask<TrustProposal?> ProposeAsync(IReadOnlyList<SignedStatementDto> chain, OperatorSet? current, PasskeyContext context, CancellationToken ct)
@@ -66,14 +69,16 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
             chain.Count == 0 ? OperatorTrust.Genesis : OperatorTrust.Fingerprint(chain[^1].Statement),
             context.RpId,
             [.. context.Origins.Order(StringComparer.Ordinal)],
-            [.. passkeys.Select(p => new OperatorKey(p.Id, p.PublicKeySpki))]);
+            [.. passkeys.Select(p => new OperatorKey(p.Id, p.PublicKeySpki))],
+            [_server.PublicKeySpki]);
         string statement = OperatorTrust.Encode(next);
         return new TrustProposal(statement, next.Version, Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement))));
     }
 
     private static bool Same(OperatorSet a, OperatorSet b) =>
         a.RpId == b.RpId && a.Origins.Order(StringComparer.Ordinal).SequenceEqual(b.Origins.Order(StringComparer.Ordinal))
-        && a.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal).SequenceEqual(b.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal));
+        && a.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal).SequenceEqual(b.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal))
+        && (a.Servers ?? []).Select(Convert.ToBase64String).Order(StringComparer.Ordinal).SequenceEqual((b.Servers ?? []).Select(Convert.ToBase64String).Order(StringComparer.Ordinal));
 
     /// <summary>
     /// 收下操作员签回来的一版（创世，或上一版里的凭证签的更新）：语句里的每把凭证都要是已注册的 passkey、域名对得上、链验得过。
@@ -102,6 +107,12 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
                 return ValidationError.Fail<TrustState>("statement", "the relying party or origins do not match this panel");
             }
 
+            if (set.Servers is not { Count: > 0 } || !set.Servers.Any(k => k.AsSpan().SequenceEqual(_server.PublicKeySpki)))
+            {
+                // 集合里没有这个面板的服务器密钥：签下去之后固定了它的节点就认不出这个面板了
+                return ValidationError.Fail<TrustState>("statement", "must list this panel's server key");
+            }
+
             IReadOnlyList<PasskeyRecord> registered = await _auth.ListAllPasskeysAsync(ct);
             if (set.Keys.Any(k => !registered.Any(p => p.Id == k.CredentialId && p.PublicKeySpki.AsSpan().SequenceEqual(k.PublicKeySpki))))
             {