feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

backend/src/MoShiro.Backend.Application/Auth/TrustService.cs

@@ -11,7 +11,8 @@ namespace MoShiro.Backend.Application;
 public sealed record TrustProposal(string Statement, int Version, string Challenge);
 
 /// <summary><c>InSync</c>：当前生效的集合和现有的 passkey、域名是否一致；不一致就需要签一个新版本。</summary>
-public sealed record TrustState(bool Initialized, string? Genesis, int Version, bool InSync, IReadOnlyList<SignedStatementDto> Chain, TrustProposal? Proposal);
+/// <param name="ServerKey">这个面板的服务器身份密钥的指纹；<c>ServerKeyListed</c>：当前生效的操作员集合里已经登记了它（节点据此认证服务器、加密链路）。</param>
+public sealed record TrustState(bool Initialized, string? Genesis, int Version, bool InSync, IReadOnlyList<SignedStatementDto> Chain, TrustProposal? Proposal, IReadOnlyList<string>? Operators = null, string ServerKey = "", bool ServerKeyListed = false);
 
 /// <summary>
 /// 信任根的 Backend 一侧：保存操作员集合的链、给操作员出下一版的语句、验证他签回来的版本。
@@ -22,11 +23,13 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
 {
     private readonly IOperatorSetStore _store;
     private readonly IAuthStore _auth;
+    private readonly ServerIdentityService _server;
     private readonly TimeProvider _time;
     private readonly SemaphoreSlim _gate = new(1, 1);
 
-    public TrustService(IOperatorSetStore store, IAuthStore auth, TimeProvider time)
+    public TrustService(IOperatorSetStore store, IAuthStore auth, ServerIdentityService server, TimeProvider time)
     {
+        _server = server;
         _store = store;
         _auth = auth;
         _time = time;
@@ -50,7 +53,7 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
         TrustProposal? proposal = await ProposeAsync(chain, current, context, ct);
         OperatorSet? proposed = proposal is null ? null : OperatorTrust.ParseSet(proposal.Statement);
         bool inSync = current is not null && proposed is not null && Same(current, proposed);
-        return new TrustState(current is not null, chain.Count == 0 ? null : OperatorTrust.Fingerprint(chain[0].Statement), current?.Version ?? 0, inSync, chain, inSync ? null : proposal);
+        return new TrustState(current is not null, chain.Count == 0 ? null : OperatorTrust.Fingerprint(chain[0].Statement), current?.Version ?? 0, inSync, chain, inSync ? null : proposal, current is null ? [] : [.. current.Keys.Select(k => k.CredentialId)], _server.Fingerprint, current?.Servers?.Any(k => k.AsSpan().SequenceEqual(_server.PublicKeySpki)) == true);
     }
 
     private async ValueTask<TrustProposal?> ProposeAsync(IReadOnlyList<SignedStatementDto> chain, OperatorSet? current, PasskeyContext context, CancellationToken ct)
@@ -66,14 +69,16 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
             chain.Count == 0 ? OperatorTrust.Genesis : OperatorTrust.Fingerprint(chain[^1].Statement),
             context.RpId,
             [.. context.Origins.Order(StringComparer.Ordinal)],
-            [.. passkeys.Select(p => new OperatorKey(p.Id, p.PublicKeySpki))]);
+            [.. passkeys.Select(p => new OperatorKey(p.Id, p.PublicKeySpki))],
+            [_server.PublicKeySpki]);
         string statement = OperatorTrust.Encode(next);
         return new TrustProposal(statement, next.Version, Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement))));
     }
 
     private static bool Same(OperatorSet a, OperatorSet b) =>
         a.RpId == b.RpId && a.Origins.Order(StringComparer.Ordinal).SequenceEqual(b.Origins.Order(StringComparer.Ordinal))
-        && a.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal).SequenceEqual(b.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal));
+        && a.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal).SequenceEqual(b.Keys.Select(k => k.CredentialId).Order(StringComparer.Ordinal))
+        && (a.Servers ?? []).Select(Convert.ToBase64String).Order(StringComparer.Ordinal).SequenceEqual((b.Servers ?? []).Select(Convert.ToBase64String).Order(StringComparer.Ordinal));
 
     /// <summary>
     /// 收下操作员签回来的一版（创世，或上一版里的凭证签的更新）：语句里的每把凭证都要是已注册的 passkey、域名对得上、链验得过。
@@ -102,6 +107,12 @@ public sealed class TrustService : IOperatorTrustSource, IDisposable
                 return ValidationError.Fail<TrustState>("statement", "the relying party or origins do not match this panel");
             }
 
+            if (set.Servers is not { Count: > 0 } || !set.Servers.Any(k => k.AsSpan().SequenceEqual(_server.PublicKeySpki)))
+            {
+                // 集合里没有这个面板的服务器密钥：签下去之后固定了它的节点就认不出这个面板了
+                return ValidationError.Fail<TrustState>("statement", "must list this panel's server key");
+            }
+
             IReadOnlyList<PasskeyRecord> registered = await _auth.ListAllPasskeysAsync(ct);
             if (set.Keys.Any(k => !registered.Any(p => p.Id == k.CredentialId && p.PublicKeySpki.AsSpan().SequenceEqual(k.PublicKeySpki))))
             {