refactor: 统一认证端点并删除冗余 profile 模块

- 合并 auth 端点: /verifications/verify → /verify, /verifications/resend → /resend
- 整合密码重置到 /verify 端点 (type=recovery)
- 移除未使用的 /auth/users 端点
- 添加 redirect URL 白名单验证 (site_url + additional_redirect_urls)
- 限流改用 Redis + IP 标识，替代内存锁
- 删除 v1/profile 死代码模块
- 更新前端 auth_api 适配新端点
- 添加 supabase site_url 和 additional_redirect_urls 配置

backend/src/v1/auth/gateway.py

@@ -3,10 +3,12 @@ from __future__ import annotations
 import asyncio
 from collections.abc import Mapping
 from typing import Any, cast
+from urllib.parse import urlparse
 
 from fastapi import HTTPException
 from supabase import AuthError
 
+from core.config.settings import config
 from core.logging import get_logger
 from services.base.supabase import supabase_service
 from v1.auth.schemas import (
@@ -47,7 +49,11 @@ class SupabaseAuthGateway(AuthServiceGateway):
             "data": metadata,
         }
         if request.redirect_to:
-            payload["options"] = {"email_redirect_to": request.redirect_to}
+            payload["options"] = {
+                "email_redirect_to": _validate_redirect_url_or_raise(
+                    request.redirect_to
+                )
+            }
         try:
             sign_up = cast(Any, client.auth.sign_up)
             await asyncio.to_thread(sign_up, payload)
@@ -61,9 +67,12 @@ class SupabaseAuthGateway(AuthServiceGateway):
     async def verify_verification(
         self, request: VerificationVerifyRequest
     ) -> SessionResponse:
+        if request.type != "signup":
+            raise HTTPException(status_code=422, detail="Invalid request")
+
         client = self._get_client()
         payload: dict[str, Any] = {
-            "type": "signup",
+            "type": request.type,
             "email": request.email,
             "token": request.token,
         }
@@ -79,7 +88,16 @@ class SupabaseAuthGateway(AuthServiceGateway):
 
     async def resend_verification(self, request: VerificationResendRequest) -> None:
         client = self._get_client()
-        payload: dict[str, Any] = {"type": "signup", "email": request.email}
+        if request.type == "recovery":
+            await self.request_password_reset(
+                PasswordResetRequest(
+                    email=request.email,
+                    redirect_to=request.redirect_to,
+                )
+            )
+            return
+
+        payload: dict[str, Any] = {"type": request.type, "email": request.email}
         try:
             resend = cast(Any, client.auth.resend)
             await asyncio.to_thread(resend, payload)
@@ -167,7 +185,9 @@ class SupabaseAuthGateway(AuthServiceGateway):
             reset_email = cast(Any, client.auth.reset_password_email)
             email = _coerce_reset_email(request.email)
             if request.redirect_to:
-                options: dict[str, str] = {"redirect_to": request.redirect_to}
+                options: dict[str, str] = {
+                    "redirect_to": _validate_redirect_url_or_raise(request.redirect_to)
+                }
                 await asyncio.to_thread(reset_email, email, options=options)
             else:
                 await asyncio.to_thread(reset_email, email)
@@ -243,11 +263,37 @@ def _map_auth_response(response: object, failure_message: str) -> SessionRespons
     )
 
 
+def _validate_redirect_url_or_raise(url: str) -> str:
+    parsed = urlparse(url)
+    if parsed.scheme not in {"http", "https"}:
+        raise HTTPException(status_code=422, detail="Invalid redirect URL")
+    if not parsed.netloc:
+        raise HTTPException(status_code=422, detail="Invalid redirect URL")
+
+    site_origin = _origin_of(config.supabase.site_url)
+    allowlist = {
+        site_origin,
+        *(_origin_of(item) for item in config.supabase.additional_redirect_urls),
+    }
+    target_origin = f"{parsed.scheme}://{parsed.netloc}".lower()
+    if target_origin not in allowlist:
+        raise HTTPException(status_code=422, detail="Invalid redirect URL")
+    return url
+
+
+def _origin_of(url: str) -> str:
+    parsed = urlparse(url.strip())
+    if parsed.scheme not in {"http", "https"} or not parsed.netloc:
+        return ""
+    return f"{parsed.scheme}://{parsed.netloc}".lower()
+
+
 def _list_auth_users(client: Any) -> list[Any]:
     users: list[Any] = []
     page = 1
+    max_pages = 100
 
-    while True:
+    while page <= max_pages:
         response = client.auth.admin.list_users(page=page, per_page=100)
         batch = list(getattr(response, "users", []))
         users.extend(batch)