refactor: JWT 无状态认证替换为服务端 Session，修复记住我掉线问题

- 新增 internal/session 包：Session 结构体、Store 接口、MemoryStore（内存+后台清理）、RedisStore 预留
- Cookie 从 3 个精简为 1 个 mlb_sid（HttpOnly），移除 JWT access/refresh cookie
- 会话过期采用滑动窗口：每次请求自动续期，记住我 30 天无操作过期
- AuthMiddleware/AuthAdmin/Maintenance 中间件改用 SessionManager.Validate()
- AuthService Login/Register/ConfirmRestore 去除 token 生成，返回 *model.User
- Controller 层在登录/注册后调用 SessionManager.Create 创建会话
- AdminService UpdateUserStatus/ResetUserToken 同步销毁 session 实现即时退登
- 改密/注销时通过 DestroyByUID 删除所有 session（替换 TokenVersion 检查）
- config.yaml 新增 session 配置段（idle_timeout/remember_timeout/cleanup_interval）
- TokenService/auth_parser/auth_token 标记废弃，移除 JWT 到期字段依赖

internal/controller/auth_controller.go

@@ -5,6 +5,7 @@ import (
 
 	"metazone.cc/metalab/internal/common"
 	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/session"
 	"metazone.cc/metalab/internal/theme"
 
 	"github.com/gin-gonic/gin"
@@ -12,15 +13,15 @@ import (
 
 // AuthController 认证相关页面 + API
 type AuthController struct {
-	authService  authUseCase
-	tokenService tokenRefresher
-	rateLimiter  rateLimiter
-	cfg          *config.Config
+	authService    authUseCase
+	sessionManager *session.Manager
+	rateLimiter    rateLimiter
+	cfg            *config.Config
 }
 
 // NewAuthController 构造函数
-func NewAuthController(authService authUseCase, tokenSvc tokenRefresher, limiter rateLimiter, cfg *config.Config) *AuthController {
-	return &AuthController{authService: authService, tokenService: tokenSvc, rateLimiter: limiter, cfg: cfg}
+func NewAuthController(authService authUseCase, sm *session.Manager, limiter rateLimiter, cfg *config.Config) *AuthController {
+	return &AuthController{authService: authService, sessionManager: sm, rateLimiter: limiter, cfg: cfg}
 }
 
 // RegisterPage 注册页面（已登录用户重定向到首页）
@@ -35,10 +36,10 @@ func (ac *AuthController) RegisterPage(c *gin.Context) {
 		return
 	}
 	c.HTML(http.StatusOK, "auth/register.html", common.BuildPageData(c, gin.H{
-		"Title":                "注册",
-		"ExtraCSS":             "/static/css/auth.css",
-		"Guidelines":           guidelines,
-		"RegistrationEnabled":  ac.authService.IsRegistrationEnabled(),
+		"Title":               "注册",
+		"ExtraCSS":            "/static/css/auth.css",
+		"Guidelines":          guidelines,
+		"RegistrationEnabled": ac.authService.IsRegistrationEnabled(),
 	}))
 }