feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]

backend/src/MoShiro.Backend.Application/Auth/Capabilities.cs

@@ -32,6 +32,7 @@ public static class Capability
     public const string KeysRead = "keys.read";
     public const string KeysManage = "keys.manage";
 
+    public const string AccountsRead = "accounts.read";
     public const string AccountsManage = "accounts.manage";
 
     public const string AuditRead = "audit.read";
@@ -78,7 +79,8 @@ public static class CapabilityCatalog
         new(Capability.KeysRead, "keys"),
         new(Capability.KeysManage, "keys", false, false, Capability.KeysRead),
 
-        new(Capability.AccountsManage, "accounts", true),
+        new(Capability.AccountsRead, "accounts"),
+        new(Capability.AccountsManage, "accounts", true, false, Capability.AccountsRead),
 
         new(Capability.EventsRead, "ops"),
         new(Capability.AuditRead, "ops"),
@@ -130,6 +132,6 @@ public static class CapabilityCatalog
         }
     }
 
-    /// <summary>登录会话的能力。在 passkey 提权落地之前（docs/access.md 第 12 节步骤 2）会话直接拥有全部能力，包括信任类。</summary>
+    /// <summary>登录会话的能力：全部，包括信任类；信任类的操作还要有效的提权窗口（<see cref="ElevationService"/>）。</summary>
     public static IReadOnlyList<string> ForSession() => [.. All.Select(c => c.Id)];
 }