v1.18.0-alpha

Features

• Cloudflare Turnstile bot protection on login/register pages
• JWT-based user authentication in manage-passkey & verify-totp Edge Functions
• Expanded Terms of Service with detailed account protection methods
• Comprehensive Privacy Policy with data collection scope, 2FA handling, third-party services
• Login/Register UI refinements (divider width matching, \邮箱登录\ label)

Security

• Edge Functions no longer trust userId from request body — now verify JWT token
• Turnstile widget validates all login methods (email, GitHub OAuth, QR code)
• TOTP secret isolated to service_role-only user_totp table
• Passkey grace period now server-side (check-grace via last_used_at)