feat: return bind credentials and reuse sync-bound agents on register (Z28)

Phone/bind-code/ticket responses include rotated client_secret; SelfRegister reuses active sync_bound hosts instead of spawning pending; archive coop opinion and keep a living summary.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/logic/applogic/agents.go

@@ -146,7 +146,12 @@ func (l *AuthLogic) SelfRegisterAgent(req *types.AgentSelfRegisterReq) (*types.A
 	}
 	msg := "已登记为 pending，请管理员在控制台分配角色并启用后再换票"
 	if reused {
-		msg = "已存在 pending 登记，已轮换 client_secret；仍须管理员分配角色并启用"
+		syncBound := strings.TrimSpace(acc.ChannelID) != "" && strings.TrimSpace(acc.OnlineDBID) != ""
+		if acc.Status == agentstore.StatusActive && syncBound {
+			msg = "已存在同步绑定账号，已轮换 client_secret；请直接用返回的 client_id/client_secret 换票，勿再走绑定表单"
+		} else {
+			msg = "已存在 pending 登记，已轮换 client_secret；仍须管理员分配角色并启用"
+		}
 	}
 	return &types.AgentSelfRegisterResp{
 		Account:      *acc,

platform/internal/logic/applogic/bind_flow.go

@@ -113,6 +113,7 @@ type BindCodeRedeemResp struct {
 	TenantID     int64  `json:"tenant_id"`
 	AgentID      int64  `json:"agent_id"`
 	ClientID     string `json:"client_id,omitempty"`
+	ClientSecret string `json:"client_secret,omitempty"` // Z28：绑定成功回传，便于直接换票
 	ChannelID    string `json:"channel_id"`
 	OnlineDBID   string `json:"online_db_id"`
 	DatabaseName string `json:"database_name,omitempty"`
@@ -158,6 +159,11 @@ func (l *AuthLogic) RedeemBindCode(req BindCodeRedeemReq) (*BindCodeRedeemResp,
 	if err != nil {
 		return nil, err
 	}
+	// Z28：回传可换票凭证
+	secret, err := l.svcCtx.Agents.RotateSecret(l.ctx, updated.TenantID, updated.AgentID)
+	if err != nil {
+		return nil, fmt.Errorf("rotate client_secret: %w", err)
+	}
 	_ = l.writeBindAudit("bind_code_redeem", updated.TenantID, updated.AgentID, map[string]any{
 		"code": bc.Code, "channel_id": bc.ChannelID, "online_db_id": online,
 	})
@@ -166,11 +172,12 @@ func (l *AuthLogic) RedeemBindCode(req BindCodeRedeemReq) (*BindCodeRedeemResp,
 		TenantID:     updated.TenantID,
 		AgentID:      updated.AgentID,
 		ClientID:     updated.ClientID,
+		ClientSecret: secret,
 		ChannelID:    updated.ChannelID,
 		OnlineDBID:   updated.OnlineDBID,
 		DatabaseName: updated.DatabaseName,
 		SyncBound:    true,
-		Message:      "绑定成功",
+		Message:      "绑定成功；请保存 client_id/client_secret 用于换票",
 	}, nil
 }
 
@@ -300,6 +307,8 @@ type PhoneConfirmResp struct {
 	OK           bool   `json:"ok"`
 	TenantID     int64  `json:"tenant_id"`
 	AgentID      int64  `json:"agent_id"`
+	ClientID     string `json:"client_id,omitempty"`
+	ClientSecret string `json:"client_secret,omitempty"` // Z28：绑定成功回传
 	ChannelID    string `json:"channel_id"`
 	OnlineDBID   string `json:"online_db_id"`
 	DatabaseName string `json:"database_name,omitempty"`
@@ -361,7 +370,7 @@ func (l *AuthLogic) PhoneConfirm(req PhoneConfirmReq) (*PhoneConfirmResp, error)
 	if u.TenantID <= 0 {
 		return nil, fmt.Errorf("该账号尚未加入公司")
 	}
-	updated, _, err := l.bindUserHostSync(u, hostKey, req.Name, req.LocalDBID, "phone-confirm")
+	updated, secret, err := l.bindUserHostSync(u, hostKey, req.Name, req.LocalDBID, "phone-confirm")
 	if err != nil {
 		return nil, err
 	}
@@ -373,11 +382,13 @@ func (l *AuthLogic) PhoneConfirm(req PhoneConfirmReq) (*PhoneConfirmResp, error)
 		OK:           true,
 		TenantID:     updated.TenantID,
 		AgentID:      updated.AgentID,
+		ClientID:     updated.ClientID,
+		ClientSecret: secret,
 		ChannelID:    updated.ChannelID,
 		OnlineDBID:   updated.OnlineDBID,
 		DatabaseName: updated.DatabaseName,
 		SyncBound:    true,
-		Message:      "绑定成功",
+		Message:      "绑定成功；请保存 client_id/client_secret 用于换票",
 	}, nil
 }
 

platform/internal/logic/applogic/yuheng_ticket.go

@@ -199,6 +199,11 @@ func (l *AuthLogic) bindUserHostSync(u *userstore.User, hostKey, name, localID,
 	if err != nil {
 		return nil, "", err
 	}
+	// Z28：绑定成功后轮换密钥并回传，宇恒可直接换票，无需再 SelfRegister pending
+	secret, err = l.svcCtx.Agents.RotateSecret(l.ctx, updated.TenantID, updated.AgentID)
+	if err != nil {
+		return nil, "", fmt.Errorf("rotate client_secret: %w", err)
+	}
 	if localID == "" {
 		localID = "host:" + hostKey
 	}