sequenceDiagram
    participant U as 用户
    participant W as 网页端
    participant S as 服务器
    participant A as App(Agent)
    U->>W: 登录(密码+TOTP 2FA可选)
    W->>S: POST /api/auth/login
    S-->>W: JWT(15min) + refresh cookie
    U->>W: 工作区→设备→添加设备
    W->>S: POST /api/agents/pairing
    S-->>W: 配对码(6位,5分钟有效)
    U->>A: 输入配对码
    A->>A: 生成Ed25519密钥对+deviceId
    A->>S: WSS auth(deviceId,配对码,公钥,签名)
    S->>S: 验证→注册公钥→签发agentToken(可吊销)
    S-->>A: 绑定成功
    A->>A: 私钥入本地保险库(DPAPI/SQLCipher)