[Audit 2026-04-14] Critical auth/session runtime bugs

[yanghao1143]

Summary

Multiple confirmed auth/session bugs can cause panic, broken login state, or request-chain truncation.

Findings

• Critical | confirmed email forget-password path reads req.Phone.Value and can panic on nil.
  • Evidence: user/private/service/auth.go:282
• Critical | confirmed refresh middleware returns early on RememberTokenUsed without next.ServeHTTP, breaking request chain.
  • Evidence: pkg/authn/session/session.go:85
• High | confirmed refresh-success path writes user context using old empty uid.
  • Evidence: pkg/authn/session/session.go:90
• High | probable session store init can nil-deref when security_cookie is missing.
  • Evidence: pkg/authn/session/session.go:118, pkg/authn/session/session.go:136

Suggested Direction

• Fix email branch lookup.
• Always continue middleware chain when appropriate.
• Use refreshed uid value.
• Add nil guards/defaults for security cookie config.