feat: operator trust root: passkey-signed operator set, signed join codes, nodes verify and pin the chain at enrollment [CI SKIP]

backend/src/MoShiro.Backend.Application/Ports/IAuthStore.cs

@@ -38,6 +38,9 @@ public interface IAuthStore
 
     ValueTask<IReadOnlyList<PasskeyRecord>> ListPasskeysAsync(string userId, CancellationToken ct);
 
+    /// <summary>所有用户的 passkey（操作员集合从这里取）。</summary>
+    ValueTask<IReadOnlyList<PasskeyRecord>> ListAllPasskeysAsync(CancellationToken ct);
+
     /// <summary>只能删自己的。</summary>
     ValueTask<bool> DeletePasskeyAsync(string userId, string credentialId, CancellationToken ct);
 

backend/src/MoShiro.Backend.Application/Ports/StorePorts.cs

@@ -54,7 +54,7 @@ public interface IGeoLookup
 
 public interface IJoinTokenStore
 {
-    ValueTask<JoinTokenInfo> CreateAsync(string id, byte[] tokenSha256, string? note, IReadOnlyList<string> labels, bool autoApprove, string kind, int maxUses, long expiresAtMs, long nowMs, string? createdBy, CancellationToken ct);
+    ValueTask<JoinTokenInfo> CreateAsync(string id, byte[] tokenSha256, string? note, IReadOnlyList<string> labels, bool autoApprove, string kind, int maxUses, long expiresAtMs, long nowMs, string? createdBy, SignedStatementDto? grant, CancellationToken ct);
 
     ValueTask<IReadOnlyList<JoinTokenInfo>> ListAsync(CancellationToken ct);
 
@@ -144,6 +144,15 @@ public interface IEventStore
     ValueTask<int> DeleteOlderThanAsync(long cutoffMs, CancellationToken ct);
 }
 
+/// <summary>操作员集合的链（passkey 签的版本，按版本号递增）。</summary>
+public interface IOperatorSetStore
+{
+    ValueTask<IReadOnlyList<SignedStatementDto>> ListAsync(CancellationToken ct);
+
+    /// <summary>追加一个版本；版本号已经有了返回 false。</summary>
+    ValueTask<bool> AddAsync(int version, SignedStatementDto signed, long nowMs, CancellationToken ct);
+}
+
 public interface IAuditStore
 {
     ValueTask AddAsync(AuditRecord record, CancellationToken ct);