feat(auth): 修复网页端登录流程，移除 web_generate_login_code 的 JWT 依赖

src/handlers/payment.rs

@@ -431,6 +431,25 @@ pub async fn payment_index() -> Result<HttpResponse, AppError> {
   let isPaidActive = false;
   let paidExpiresAt = null;
 
+  // ---- 页面初始化：检查 URL 中的 code 参数 ----
+  (function initFromUrl() {
+    const params = new URLSearchParams(window.location.search);
+    const urlCode = params.get('code');
+    if (urlCode) {
+      currentShortCode = urlCode;
+      document.getElementById('codeValue').textContent = currentShortCode;
+      document.getElementById('codeDisplay').style.display = 'block';
+      document.getElementById('scanStatus').style.display = 'block';
+      document.getElementById('scanStatus').className = 'scan-status waiting';
+      document.getElementById('scanStatus').textContent = '等待小程序授权确认...';
+      document.getElementById('btnGenerate').style.display = 'none';
+      document.getElementById('btnRefresh').style.display = 'block';
+      // 启动轮询
+      if (pollTimer) clearInterval(pollTimer);
+      pollTimer = setInterval(pollLoginStatus, 2000);
+    }
+  })();
+
   // ---- 登录码流程（正式版）----
   async function generateCode() {
     hideError();
@@ -960,17 +979,17 @@ pub async fn payment_login_status(
 ) -> Result<HttpResponse, AppError> {
     let code = query.code.trim();
 
-    // 查询登录码记录
-    let record: Option<(String, chrono::DateTime<chrono::Utc>, Option<i32>)> =
+    // 查询登录码记录（包含 token 字段用于判断是否已确认）
+    let record: Option<(String, chrono::DateTime<chrono::Utc>, Option<String>, Option<i32>)> =
         sqlx::query_as(
-            "SELECT code, expires_at, user_id FROM web_login_codes WHERE code = $1",
+            "SELECT code, expires_at, token, user_id FROM web_login_codes WHERE code = $1",
         )
         .bind(code)
         .fetch_optional(pool.get_ref())
         .await
         .map_err(|e| AppError::Internal(format!("数据库查询失败: {}", e)))?;
 
-    let (db_code, expires_at, user_id) = match record {
+    let (db_code, expires_at, token, user_id) = match record {
         Some(r) => r,
         None => {
             return Ok(HttpResponse::Ok().json(LoginStatusResponse {
@@ -998,9 +1017,9 @@ pub async fn payment_login_status(
         }));
     }
 
-    // 登录码存在但还没被小程序确认（user_id 为空 = 刚生成，还没点确认）
-    // 这种情况返回 confirmed=false，继续轮询
-    if user_id.is_none() {
+    // 登录码存在但还没被小程序确认（token 为空 = 刚生成，还没点确认）
+    // 使用 token 字段判断是否已确认（而非 user_id，因为 web_generate_login_code 会设置 user_id）
+    if token.is_none() {
         return Ok(HttpResponse::Ok().json(LoginStatusResponse {
             success: true,
             confirmed: false,
@@ -1010,19 +1029,10 @@ pub async fn payment_login_status(
         }));
     }
 
-    // 已确认 → 获取用户信息和 openid，生成 JWT
+    // 已确认 → 使用已生成的 token
+    let token = token.unwrap();
     let user_id = user_id.unwrap();
 
-    let (openid,): (String,) = sqlx::query_as("SELECT openid FROM users WHERE id = $1")
-        .bind(user_id)
-        .fetch_optional(pool.get_ref())
-        .await
-        .map_err(|e| AppError::Internal(format!("数据库查询失败: {}", e)))?
-        .ok_or_else(|| AppError::Internal("用户不存在".to_string()))?;
-
-    let token = crate::auth::generate_token(user_id, &openid, 2, &app_state.jwt_secret)
-        .map_err(|e| AppError::Internal(format!("生成令牌失败: {}", e)))?;
-
     let (is_paid_active, paid_expires_at): (bool, Option<String>) =
         match sqlx::query_as::<_, (bool, Option<chrono::DateTime<chrono::Utc>>)>("SELECT is_paid_active($1)")
             .bind(user_id)