fix: 修复注册接口和 refresh 接口账号枚举漏洞

- /register: 已存在账号返回相同成功消息，不再暴露账号是否存在
- /refresh: 将 'User not found' 改为 'Token 无效'
- 防止攻击者通过错误提示枚举有效账号

backend/app/api/auth.py

@@ -25,15 +25,14 @@ class RegisterResponse(BaseModel):
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     account = req.account.strip().lower()
     result = await db.execute(select(User).where(User.email == account))
-    if result.scalar_one_or_none():
-        raise HTTPException(status_code=400, detail="账号已注册")
+    if not result.scalar_one_or_none():
         user = User(
             email=account, password_hash=hash_password(req.password),
             nickname=req.nickname, status="pending", group_id=req.group_id,
         )
         db.add(user)
         await db.commit()
-    return RegisterResponse(message="注册成功，等待管理员审批")
+    return RegisterResponse(message="注册请求已提交，等待管理员审批")
 
 
 @router.post("/login", response_model=TokenResponse)
@@ -92,7 +91,7 @@ async def refresh(req: RefreshRequest, db: AsyncSession = Depends(get_db)):
     result = await db.execute(select(User).where(User.id == user_id))
     user = result.scalar_one_or_none()
     if not user:
-        raise HTTPException(status_code=401, detail="User not found")
+        raise HTTPException(status_code=401, detail="Token 无效")
     if user.status == "pending":
         raise HTTPException(status_code=403, detail="账户正在等待管理员审批")
     if user.status == "disabled":