Improve local auth env handling and fallbacks

Allow local env files to reliably override authentication feature flags (SMS/WeChat) by whitelisting keys in scripts/dev-utils.mjs and adding a unit test. Add SMS checks to scripts/check-api-server-env.mjs. Make server config.parse_bool tolerant of shell-wrapped quoted values (e.g. '"true"') and add tests so SMS_AUTH_ENABLED is parsed correctly when shells supply quotes. Update docs to clarify SMS env behaviour, restart requirements, and add guidance + a CSS fallback for old mobile browsers (QQ/X5) so public cover images render even when aspect-ratio is unsupported. Also include related frontend test and component adjustments and add puzzle onboarding handlers/endpoints in server-rs/crates/api-server/src/puzzle.rs.

src/components/auth/AuthGate.tsx

@@ -61,7 +61,7 @@ type AuthStatus =
   | 'ready'
   | 'error';
 
-const FALLBACK_LOGIN_METHODS: AuthLoginMethod[] = ['password'];
+const REQUIRED_LOGIN_METHODS: AuthLoginMethod[] = ['phone', 'password'];
 
 function readInviteCodeFromLocation(): string {
   const params = new URLSearchParams(window.location.search || '');
@@ -76,11 +76,13 @@ function normalizeAvailableLoginMethods(
 ): AuthLoginMethod[] {
   const normalizedMethods = Array.from(new Set(methods ?? []));
 
-  // 密码登录由 Rust auth entry 固定承载，不依赖短信或微信环境开关。
-  // 当 login-options 联调失败或配置返回空数组时，仍要保留账号入口，避免登录弹窗失去可操作方式。
-  return normalizedMethods.length > 0
-    ? normalizedMethods
-    : FALLBACK_LOGIN_METHODS;
+  // 登录面板的核心入口必须稳定展示，login-options 只补充微信等环境相关入口。
+  return Array.from(
+    new Set<AuthLoginMethod>([
+      ...REQUIRED_LOGIN_METHODS,
+      ...normalizedMethods,
+    ]),
+  );
 }
 
 type AuthHydrateSessionResult =
@@ -367,9 +369,9 @@ export function AuthGate({ children }: AuthGateProps) {
             return;
           }
 
-          setAvailableLoginMethods(FALLBACK_LOGIN_METHODS);
+          setAvailableLoginMethods(REQUIRED_LOGIN_METHODS);
           setUser(null);
-          // 中文注释：登录方式接口失败时按产品约定保留密码登录入口；
+          // 中文注释：登录方式接口失败时按产品约定保留验证码和密码登录入口；
           // 这里不展示接口读取错误，避免用户误以为登录本身不可用。
           setError(callbackResult?.error ?? '');
           setStatus('unauthenticated');