feat: 心跳接口改用JWT token获取用户设备信息

- JWT Claims 增加 device_id 和 instance_id 字段
- 登录时将设备信息编码到 token
- 心跳接口从 token 自动获取用户和设备信息
- 心跳路由移到需要 JWT 认证的路由组
- 更新 API 文档

优点：
- 更安全：无法伪造设备信息
- 请求更简洁：心跳无需传递参数
- 符合业界标准做法

Co-Authored-By: Claude <noreply@anthropic.com>

backend/internal/router/app/account.go

@@ -65,23 +65,40 @@ func handleAppHeartbeat(c *gin.Context) {
 		return
 	}
 
-	var req struct {
-		UserID     uint   `json:"user_id"`
-		DeviceID   string `json:"device_id"`
-		InstanceID string `json:"instance_id"`
-	}
-	if err := c.ShouldBindJSON(&req); err != nil {
-		response.Error(c, 400, "参数错误")
+	// 从 JWT token 中获取用户信息
+	userIDInterface, exists := c.Get("user_id")
+	if !exists {
+		response.Error(c, 401, "未授权")
 		return
 	}
+	userID := userIDInterface.(uint)
+
+	usernameInterface, _ := c.Get("username")
+	username := usernameInterface.(string)
+
+	// 从 JWT token 中获取设备信息
+	deviceIDInterface, exists := c.Get("device_id")
+	deviceID := ""
+	if exists {
+		deviceID = deviceIDInterface.(string)
+	}
+
+	instanceIDInterface, exists := c.Get("instance_id")
+	instanceID := ""
+	if exists {
+		instanceID = instanceIDInterface.(string)
+	}
+	if instanceID == "" {
+		instanceID = deviceID
+	}
 
 	var user model.AppUser
-	if err := database.DB.First(&user, req.UserID).Error; err != nil {
+	if err := database.DB.First(&user, userID).Error; err != nil {
 		response.Error(c, 404, "用户不存在")
 		return
 	}
 
-	if blocked, reason := checkRiskControl(c, app.ID, req.DeviceID, user.Username); blocked {
+	if blocked, reason := checkRiskControl(c, app.ID, deviceID, username); blocked {
 		log.Printf("[DEBUG] Heartbeat blocked by risk control: %s", reason)
 		response.Error(c, 403, reason)
 		return
@@ -145,16 +162,16 @@ func handleAppHeartbeat(c *gin.Context) {
 		return
 	}
 
-	if req.DeviceID != "" {
+	if deviceID != "" {
 		var device model.UserDevice
-		err := database.DB.Where("user_id = ? AND application_id = ? AND device_id = ?", user.ID, app.ID, req.DeviceID).First(&device).Error
+		err := database.DB.Where("user_id = ? AND application_id = ? AND device_id = ?", user.ID, app.ID, deviceID).First(&device).Error
 
 		if err != nil {
 			device = model.UserDevice{
 				UserID:        user.ID,
 				ApplicationID: app.ID,
-				DeviceID:      req.DeviceID,
-				DeviceName:    req.DeviceID,
+				DeviceID:      deviceID,
+				DeviceName:    deviceID,
 				Status:        "active",
 			}
 			if err := database.DB.Create(&device).Error; err != nil {
@@ -162,11 +179,6 @@ func handleAppHeartbeat(c *gin.Context) {
 			}
 		}
 
-		instanceID := req.InstanceID
-		if instanceID == "" {
-			instanceID = req.DeviceID
-		}
-
 		if device.ID > 0 {
 			var session model.DeviceSession
 			sessionErr := database.DB.Where("device_id = ? AND instance_id = ?", device.ID, instanceID).First(&session).Error