feat(auth): 移除多角色体验账号直登，仅保留微信手机号授权登录

- 登录页删除体验账号卡片、切换按钮与全部 demo 登录/失败回退逻辑，微信授权失败只提示重试

- completeLogin 只接受服务端签发的 token，禁止无 token 的假登录

- 删除 /api/auth/demo-accounts、/api/auth/demo-login、loadDemoAccounts 与客户端 API

- 停止种子 demo_accounts 配置并清理历史配置行；117 套件/763 用例全绿；线上接口已 404

server/tests/content-security.spec.ts

@@ -517,8 +517,10 @@ describe('ContentSecurityService & Compliance Architecture (TDD 微信内容安
       expect(content).toContain('open-type="getPhoneNumber"');
       expect(content).toContain('@getphonenumber="handleGetPhoneNumber"');
       expect(content).toContain('一键授权快捷登录');
-      expect(content).toContain('getDemoAccounts');
-      expect(content).toContain('demoLogin');
+      // 测试/演示账号直登已下线，只允许微信手机号授权登录
+      expect(content).not.toContain('getDemoAccounts');
+      expect(content).not.toContain('demoLogin');
+      expect(content).not.toContain('多角色体验账号直登');
       expect(content).toContain('用户服务协议');
       expect(content).toContain('隐私保护指引');
       // 验证已彻底移除登录大门前强制填写的头像昵称卡片，保障成熟商业极速登录体验

server/tests/demo-login-removed.spec.ts

@@ -0,0 +1,44 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 体验账号直登下线闸门：
+ * 测试/演示账号不是真实微信授权用户，不允许再作为登录入口或失败回退。
+ */
+describe('体验账号直登已下线', () => {
+  const root = path.resolve(__dirname, '../../');
+  const read = (rel: string) => fs.readFileSync(path.join(root, rel), 'utf-8');
+  const login = read('pwuniapp/pages/auth/login.vue');
+  const api = read('pwuniapp/common/api.js');
+  const indexCode = read('server/src/index.ts');
+  const mysql = read('server/src/db/mysql.ts');
+
+  it('登录页不得保留测试账号列表、切换按钮或回退登录', () => {
+    expect(login).not.toContain('demo-accounts-card');
+    expect(login).not.toContain('多角色体验账号直登');
+    expect(login).not.toContain('loginWithDemo');
+    expect(login).not.toContain('loginFirstDemoAccount');
+    expect(login).not.toContain('getDemoAccounts');
+    expect(login).not.toContain('demoLogin');
+  });
+
+  it('客户端 API 与后端路由必须移除', () => {
+    expect(api).not.toContain('/auth/demo-accounts');
+    expect(api).not.toContain('/auth/demo-login');
+    expect(indexCode).not.toContain('/api/auth/demo-accounts');
+    expect(indexCode).not.toContain('/api/auth/demo-login');
+    expect(indexCode).not.toContain('loadDemoAccounts');
+  });
+
+  it('数据库不再种子体验账号配置，并清理历史配置', () => {
+    expect(mysql).toContain("DELETE FROM platform_configs WHERE config_key = 'demo_accounts'");
+    expect(mysql).not.toContain('体验账号配置');
+  });
+
+  it('微信授权失败时只提示重试，不再引导体验账号登录', () => {
+    expect(login).not.toContain('体验账号');
+    expect(login).toContain('请在微信小程序内使用手机号快捷登录');
+    expect(login).toContain('需要授权微信手机号才能登录');
+  });
+});

server/tests/login-identity-consistency.spec.ts

@@ -12,10 +12,12 @@ describe('第九十批登录态一致性闸门', () => {
   const api = fs.readFileSync(path.join(root, 'pwuniapp/common/api.js'), 'utf-8');
   const login = fs.readFileSync(path.join(root, 'pwuniapp/pages/auth/login.vue'), 'utf-8');
 
-  it('completeLogin 原子写入 userId 与 token（无 token 时清除旧 token）', () => {
+  it('completeLogin 只接受服务端签发的 token，缺失时拒绝登录', () => {
     expect(login).toContain('const completeLogin = (userId, customData = {}, sessionToken = \'\')');
-    expect(login).toContain('uni.removeStorageSync(\'userToken\')');
+    expect(login).toContain('if (!sessionToken)');
     expect(login).toContain('uni.setStorageSync(\'userToken\', sessionToken)');
+    // 不再存在"无 token 只写 userId"的体验登录路径
+    expect(login).not.toContain('uni.removeStorageSync(\'userToken\')');
   });
 
   it('微信登录把 token 交给 completeLogin 统一落库', () => {