refactor: 拆掉 auth_system 包内循环依赖，路径常量收敛到 db 单一来源

为什么：auth_system 的 11 个子模块此前构成一个强连通分量——db.py 与 backup.py
为了「动态读取路径常量」而在模块级 `import auth_system`（包自身），而包 __init__
又再导出这两个子模块的全部符号，互相指成环。

这个环当前并不崩（实测 8/8 种导入姿势全通过），它的代价是**双绑定**：
`auth_system.DB_PATH is auth_system.db.DB_PATH` 初始为 True，但只 patch 其一
另一处不跟随。于是测试不得不把 4 个路径常量**两处都 patch**
（setattr(auth,...) + setattr(db,...)）——而漏 patch 的后果是静默写生产库，
commit fc7fc21 修的那次「黄金测试写进生产库」正是这么来的。

改法：让路径常量回归**模块属性单一来源**。
- db.py：删掉 `import auth_system`，内部改用本模块常量（DATA_DIR / DB_PATH /
  SECRET_KEY_PATH）。这些常量本就定义在本模块，绕道包属性纯属多余。
- backup.py：改用 `import auth_system.db as db` 做模块限定访问，路径走
  db.BACKUP_DIR / db.DB_PATH——保留动态读取能力，来源从「包属性」换成
  「db 模块」，与唯一来源一致。
  注意**不能**写成 `from . import db`：该形式在静态图里同时指向包本身与子模块，
  会把这个环重新连上（实测确实如此，SCC 从 11 降到 2 就卡住了）。
- admin_site.py：5 处 `auth.DB_PATH` / `auth.BACKUP_DIR`（auth 是包别名）同样
  改为经 db 模块访问。**这处不修就会出事**——它读的是包属性快照，而测试已改为
  patch db 模块，于是备份上传会静默落到生产 data/backups/（本次实测真的发生了，
  2 个 upload_*.db 已清理，副本留在临时目录）。
- 测试：7 个文件的 patch 目标从包属性迁到 auth_system.db.*。
- __init__.py：补注释说明这些常量在此只是 import 快照，禁止经包属性重定向。

验证：
- Tarjan 重算：非平凡强连通分量 11 → **0**（import 图已是 DAG）
- AST 全仓扫描：经包属性访问路径常量的点 **0 处残留**
- 行为：子进程内 patch auth_system.db.* 后，get_conn 连的库 / create_backup
  落盘目录 / get_secret_key 目标路径**三者全部跟随**
- 导入姿势回归 8/8 通过
- 门禁：ruff 0 · pyright 0 errors 0 warnings · pytest 175 passed

tests/test_admin_backup_upload.py

@@ -29,10 +29,10 @@ def client(tmp_path, monkeypatch):
     import auth_system as auth
     import core.db as db
 
-    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth, 'DB_PATH', tmp_path / 'site.db')
-    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth.db, 'DB_PATH', tmp_path / 'site.db')
+    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(db, 'DB_PATH', tmp_path / 'site.db')
     auth.init_db()

tests/test_auth_db_concurrency.py

@@ -11,10 +11,10 @@ import auth_system
 
 @pytest.fixture()
 def temp_site(tmp_path, monkeypatch):
-    monkeypatch.setattr(auth_system, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth_system, 'DB_PATH', tmp_path / 'site.db')
-    monkeypatch.setattr(auth_system, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth_system, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth_system.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth_system.db, 'DB_PATH', tmp_path / 'site.db')
+    monkeypatch.setattr(auth_system.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth_system.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     auth_system.init_db()
     return tmp_path / 'site.db'
 

tests/test_auth_routes.py

@@ -20,10 +20,10 @@ ADMIN_PW = 'AdminPass123'
 def app_env(tmp_path, monkeypatch):
     """沙箱站点库 + 独立密钥，隔离生产数据。"""
     db_path = tmp_path / 'site.db'
-    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth, 'DB_PATH', db_path)
-    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth.db, 'DB_PATH', db_path)
+    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(db, 'DB_PATH', db_path)
     auth.init_db()

tests/test_download_billing.py

@@ -21,10 +21,10 @@ PW = 'Passw0rd12'
 @pytest.fixture()
 def env(tmp_path, monkeypatch):
     db_path = tmp_path / 'site.db'
-    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth, 'DB_PATH', db_path)
-    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth.db, 'DB_PATH', db_path)
+    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(db, 'DB_PATH', db_path)
     auth.init_db()

tests/test_golden.py

@@ -41,7 +41,7 @@ def _session_for(role):
     读的是 `auth_system.DB_PATH`（而非写死 'data/site.db'）——fixture 已把它
     指向临时副本，这样造 Cookie 与请求命中的是同一个库。
     """
-    conn = sqlite3.connect(str(auth_system.DB_PATH))
+    conn = sqlite3.connect(str(auth_system.db.DB_PATH))
     conn.row_factory = sqlite3.Row
     try:
         where = "role = 'admin'" if role == 'admin' else "role != 'admin' AND status = 1"
@@ -76,8 +76,8 @@ def client(tmp_path, monkeypatch):
     # 把 users.last_active 顶到测试时刻）。改成副本后契约保真度不变（同一份数据），
     # 写入全部落在 tmp_path。
     _copy_db(Path('data/site.db'), tmp_path / 'site.db')
-    monkeypatch.setattr(auth_system, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth_system, 'DB_PATH', tmp_path / 'site.db')
+    monkeypatch.setattr(auth_system.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth_system.db, 'DB_PATH', tmp_path / 'site.db')
     monkeypatch.setattr(core_db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(core_db, 'DB_PATH', tmp_path / 'site.db')
     monkeypatch.setattr('web.deps.secret_key', lambda: SECRET)

tests/test_register.py

@@ -22,10 +22,10 @@ SECRET = 'register-test-secret'
 @pytest.fixture()
 def env(tmp_path, monkeypatch):
     db_path = tmp_path / 'site.db'
-    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth, 'DB_PATH', db_path)
-    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth.db, 'DB_PATH', db_path)
+    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(db, 'DB_PATH', db_path)
     auth.init_db()

tests/test_root_mode.py

@@ -35,10 +35,10 @@ def root_client(tmp_path, monkeypatch):
     import auth_system as auth
     import core.db as db
 
-    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
-    monkeypatch.setattr(auth, 'DB_PATH', tmp_path / 'site.db')
-    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
-    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(auth.db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth.db, 'DB_PATH', tmp_path / 'site.db')
+    monkeypatch.setattr(auth.db, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth.db, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
     monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
     monkeypatch.setattr(db, 'DB_PATH', tmp_path / 'site.db')
     auth.init_db()