feat: add database-backed console login

internal/storage/mysql/task_store.go

@@ -58,7 +58,27 @@ func authenticate(ctx context.Context, tx *sql.Tx, token auth.Token) (auth.Permi
 		return auth.Permissions{}, err
 	}
 	if subtle.ConstantTimeCompare(digest[:], token.Digest[:]) != 1 {
-		return auth.Permissions{}, fault.Unauthorized
+		// 控制台会话使用独立的短期令牌摘要，不轮换也不覆盖业务 SDK
+		// 凭据。只有经过会话表、账号、命名空间和应用启停状态联合校验，
+		// 才允许沿用该业务凭据的权限快照。
+		var sessionPermissions []byte
+		sessionErr := tx.QueryRowContext(ctx, `SELECT c.permissions
+            FROM orbit_console_sessions s
+            JOIN orbit_console_users u ON u.id=s.user_id AND u.enabled=TRUE
+            JOIN orbit_credentials c ON c.namespace_id=s.namespace_id AND c.id=s.credential_id
+            JOIN orbit_namespaces n ON n.id=s.namespace_id AND n.enabled=TRUE
+            JOIN orbit_applications a ON a.id=n.application_id AND a.enabled=TRUE
+            WHERE s.namespace_id=? AND s.credential_id=? AND s.token_digest=?
+              AND s.revoked_at IS NULL AND s.expires_at>UTC_TIMESTAMP(6)
+              AND c.revoked_at IS NULL AND (c.expires_at IS NULL OR c.expires_at>UTC_TIMESTAMP(6))
+            FOR SHARE`, token.NamespaceID, token.CredentialID, token.Digest).Scan(&sessionPermissions)
+		if errors.Is(sessionErr, sql.ErrNoRows) {
+			return auth.Permissions{}, fault.Unauthorized
+		}
+		if sessionErr != nil {
+			return auth.Permissions{}, sessionErr
+		}
+		raw = sessionPermissions
 	}
 	var p auth.Permissions
 	if json.Unmarshal(raw, &p) != nil || p.Validate() != nil {