feat(security): add distributed authorization foundation

Tiku.Api/Controllers/AuthController.cs

@@ -28,6 +28,8 @@ public sealed class AuthController(
     [AllowAnonymous]
     [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
     [HttpPost("sms/send")]
+    [EndpointSummary("发送短信验证码")]
+    [EndpointDescription("发送登录用途短信验证码，并应用租户级短信限流。")]
     [ProducesResponseType<SmsSendResult>(StatusCodes.Status202Accepted)]
     [ProducesResponseType<ProblemDetails>(StatusCodes.Status400BadRequest)]
     [ProducesResponseType<ProblemDetails>(StatusCodes.Status429TooManyRequests)]
@@ -86,6 +88,7 @@ public sealed class AuthController(
     }
 
     [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
     [HttpPost("login/sms")]
     [EndpointSummary("短信验证码登录")]
     [EndpointDescription("校验已发送的登录用途短信验证码，成功后签发 JWT access token 与数据库 refresh/session。")]
@@ -195,6 +198,8 @@ public sealed class AuthController(
 
     [HttpPost("logout-all")]
     [Authorize]
+    [EndpointSummary("退出全部登录会话")]
+    [EndpointDescription("撤销当前用户全部 refresh/session，会话校验开启时旧 access token 也会被拒绝。")]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     public async Task<IActionResult> LogoutAll(CancellationToken cancellationToken)
     {
@@ -210,6 +215,8 @@ public sealed class AuthController(
     [AllowAnonymous]
     [HttpPost("password/change-required")]
     [EnableRateLimiting(AuthRateLimitPolicies.Password)]
+    [EndpointSummary("修改首次登录必改密码")]
+    [EndpointDescription("校验密码变更挑战令牌并设置新密码，成功后签发新的登录会话。")]
     public async Task<ActionResult<AuthenticationResultDto>> ChangeRequiredPassword(
         [FromBody] RequiredPasswordChangeDto request,
         CancellationToken cancellationToken)