fix: 修复找回密码接口账号枚举漏洞

- verify-reset-code: 将'账号不存在'改为'验证码错误或已过期'
- reset-password: 将'账号不存在'改为'验证码错误或已过期'
- 防止攻击者通过错误提示枚举有效账号

backend/app/api/auth.py

@@ -223,7 +223,7 @@ async def verify_reset_code(
 ):
     user = await _find_user_by_account_or_email(db, req.account)
     if not user:
-        raise HTTPException(status_code=400, detail="账号不存在")
+        raise HTTPException(status_code=400, detail="验证码错误或已过期，请重新获取")
     key = _build_code_key(user.id)
     result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
     setting = result.scalar_one_or_none()
@@ -248,7 +248,7 @@ async def reset_password(
 ):
     user = await _find_user_by_account_or_email(db, req.account)
     if not user:
-        raise HTTPException(status_code=400, detail="账号不存在")
+        raise HTTPException(status_code=400, detail="验证码错误或已过期，请重新获取")
     key = _build_code_key(user.id)
     result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
     setting = result.scalar_one_or_none()