refactor: 统一认证端点并删除冗余 profile 模块

- 合并 auth 端点: /verifications/verify → /verify, /verifications/resend → /resend
- 整合密码重置到 /verify 端点 (type=recovery)
- 移除未使用的 /auth/users 端点
- 添加 redirect URL 白名单验证 (site_url + additional_redirect_urls)
- 限流改用 Redis + IP 标识，替代内存锁
- 删除 v1/profile 死代码模块
- 更新前端 auth_api 适配新端点
- 添加 supabase site_url 和 additional_redirect_urls 配置

backend/tests/unit/v1/auth/test_auth_models.py

@@ -33,6 +33,25 @@ def test_signup_verify_requires_six_digit_token() -> None:
         VerificationVerifyRequest(email="user@example.com", token="abc123")
 
 
+def test_signup_verify_disallows_new_password() -> None:
+    with pytest.raises(ValidationError):
+        VerificationVerifyRequest(
+            type="signup",
+            email="user@example.com",
+            token="123456",
+            new_password="secret123",
+        )
+
+
+def test_recovery_verify_requires_new_password() -> None:
+    with pytest.raises(ValidationError):
+        VerificationVerifyRequest(
+            type="recovery",
+            email="user@example.com",
+            token="123456",
+        )
+
+
 def test_signup_resend_requires_valid_email() -> None:
     with pytest.raises(ValidationError):
         VerificationResendRequest(email="invalid")