feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]

backend/src/MoShiro.Backend.Api/Contracts/AdminDtos.cs

@@ -9,7 +9,15 @@ public sealed record LoginRequest(string Username, string Password, bool? Return
 public sealed record PasskeyCreationOptionsDto(string Challenge, string RpId, string RpName, string UserId, string UserName, IReadOnlyList<string> ExcludeCredentials, int TimeoutMs);
 
 /// <summary>浏览器 <c>navigator.credentials.get</c> 要的参数（可发现凭证：不需要先输用户名）。</summary>
-public sealed record PasskeyRequestOptionsDto(string Challenge, string RpId, int TimeoutMs);
+/// <param name="AllowCredentials">只有提权的挑战会带：这个用户自己的 passkey 的凭证 id。</param>
+public sealed record PasskeyRequestOptionsDto(string Challenge, string RpId, int TimeoutMs, IReadOnlyList<string>? AllowCredentials = null);
+
+/// <param name="Class"><c>enroll</c>（加节点）、<c>revoke</c>（吊销和删除）、<c>credential</c>（改凭证，用一次就没有）。</param>
+public sealed record ElevationRequest(string Class);
+
+public sealed record ElevationAssertionRequest(string Class, string CredentialId, string AuthenticatorData, string ClientDataJson, string Signature);
+
+public sealed record ElevationDto(string Class, DateTimeOffset ExpiresAt);
 
 public sealed record RegisterPasskeyRequest(string Name, string CredentialId, string AttestationObject, string ClientDataJson, IReadOnlyList<string>? Transports);