browser/openspec/changes/fix-platform-auth-session-api/proposal.md

Why

The platform_web console already calls authentication, current-user, profile, theme, and user update endpoints, but the platform API has those routes deferred. That mismatch makes login/register appear broken and encourages the frontend local fallback to grant a platform administrator session without credentials.

What Changes

• Add a minimal first-party username/email + password session API for login, registration, logout, and current-user lookup.
• Store password hashes in platform-owned user records and never expose password material to platform_web.
• Default public registration to pending server-admin scope instead of platform administrator privileges.
• Add controlled user update support so the 用户管理 page can change user status through the API.
• Restrict frontend local fallback to development/demo mode and downgrade it away from platform administrator privileges.

Impact

• Affects platform/ and platform_web/.
• Keeps authentication in platform only; plugins do not receive raw credentials or auth secrets.
• Does not add OAuth, SMS, production persistence, billing, cloud host sales, or unrelated marketplace behavior.