## Why

The platform_web console already calls authentication, current-user, profile, theme, and user update endpoints, but the platform API has those routes deferred. That mismatch makes login/register appear broken and encourages the frontend local fallback to grant a platform administrator session without credentials.

## What Changes

- Add a minimal first-party username/email + password session API for login, registration, logout, and current-user lookup.
- Store password hashes in platform-owned user records and never expose password material to platform_web.
- Default public registration to pending server-admin scope instead of platform administrator privileges.
- Add controlled user update support so the 用户管理 page can change user status through the API.
- Restrict frontend local fallback to development/demo mode and downgrade it away from platform administrator privileges.

## Impact

- Affects `platform/` and `platform_web/`.
- Keeps authentication in platform only; plugins do not receive raw credentials or auth secrets.
- Does not add OAuth, SMS, production persistence, billing, cloud host sales, or unrelated marketplace behavior.