refactor: 迁移收尾（管理员2FA）+ 抽取公共工具层，消除 router 间重复

补齐最后缺口：
- POST /api/v1/auth/admin_login/email、/auth/admin_login/verify（管理员 2FA Step2/3），
  复用 auth_routes 的票据表与尝试上限（跨栈共享），签发会话 Cookie

重构（消除约 200 行重复，11 个 router 受益）：
- web/request_utils.py：request_data / safe_int / extract_id / cookies / dedup_ids
  原在各 router 各复制一份，现集中
- web/serializers.py：format_credits / user_public / record_req_log
- 各 router 改为导入别名，行为逐字不变

覆盖率：Flask 90 条业务路由全部有 FastAPI 等价端点（含 5 个向后兼容别名）。
验证：pytest 69/69；ruff All checks passed；pyright 0 errors；奇偶 36/36；冒烟 10/10。

web/routers/download.py

@@ -21,12 +21,16 @@ from fastapi import APIRouter, Depends, Request
 
 from core import media
 from core.config import VALID_QUALITY_LEVELS
-from core.state import REQ_LOG
 from music_api import APIException
 from web import ratelimit
 from web.billing import require_billing
 from web.deps import SiteUser, current_user, require_login
+from web.request_utils import cookies as _cookies
+from web.request_utils import extract_id as _extract_id
+from web.request_utils import request_data as _request_data
+from web.request_utils import safe_int as _safe_int
 from web.response import error, success
+from web.serializers import record_req_log as _record_log
 from web.tasks_registry import register_download_task, start_task
 
 router = APIRouter()
@@ -36,41 +40,12 @@ LoginUser = Annotated[SiteUser, Depends(require_login)]
 logger = logging.getLogger('web.download')
 
 
-async def _request_data(request: Request) -> dict[str, Any]:
-    data: dict[str, Any] = {}
-    if request.method == 'GET':
-        data.update(dict(request.query_params))
-        return data
-    try:
-        body = await request.json()
-        if isinstance(body, dict):
-            data.update(body)
-    except Exception:
-        pass
-    if not data:
-        try:
-            form = await request.form()
-            data.update(dict(form.items()))
-        except Exception:
-            pass
-    return data
-
-
-def _extract_id(raw: Any) -> str:
-    from web.routers.music import _extract_id as _ex
-    return _ex(raw)
-
 
 def _parse_meta_fields(raw: Any):
     from core.utils import parse_meta_fields
     return parse_meta_fields(raw)
 
 
-def _record_log(action: str, ip: str, song: str) -> None:
-    REQ_LOG.append({'action': action, 'ip': ip, 'song': str(song or '')[:100],
-                    'time': time.strftime('%Y-%m-%d %H:%M:%S')})
-    if len(REQ_LOG) > 2000:
-        del REQ_LOG[:len(REQ_LOG) - 2000]
 
 
 def _dedup_ids(raw_ids: Any) -> list[str]:
@@ -88,11 +63,6 @@ def _dedup_ids(raw_ids: Any) -> list[str]:
     return out
 
 
-def _cookies(data: dict[str, Any]) -> dict[str, str]:
-    import music_api
-    return music_api.load_cookies()
-
-
 async def _resolve_personal(data: dict[str, Any], user: SiteUser | None, request: Request):
     from web.routers.music import _resolve_user_cookies
     return await _resolve_user_cookies(data, user, request)
@@ -135,7 +105,7 @@ async def download(user: Annotated[SiteUser | None, Depends(current_user)], requ
             if not cookies:
                 return await _fail('请先扫码登录个人账号后再使用个人解析', 401)
         else:
-            cookies = _cookies(data)
+            cookies = _cookies()
 
         filename_format = data.get('filename_format', 'artist_song')
         write_meta = str(data.get('write_meta', 'true')).lower() in ('1', 'true', 'yes')
@@ -276,7 +246,7 @@ async def download_batch_zip(user: Annotated[SiteUser | None, Depends(current_us
             concurrency = 8
         concurrency = max(1, min(10, concurrency))
 
-        cookies = _cookies(data)
+        cookies = _cookies()
         device_id = str(data.get('device_id') or '').strip()[:64]
         import main as legacy
         await asyncio.to_thread(legacy._touch_device, device_id)
@@ -322,11 +292,6 @@ def _podcast_billing_count(data: dict[str, Any]) -> int:
     return max(1, min(len(ids), limit))
 
 
-def _safe_int(value: Any, default: int) -> int:
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return default
 
 
 def _podcast_quality(data: dict[str, Any]) -> str:
@@ -362,7 +327,7 @@ async def podcast_download(user: Annotated[SiteUser | None, Depends(current_user
                 await billing.refund_open('rejected')
                 return error('请先扫码登录个人账号后再使用个人解析', 401)
         else:
-            cookies = _cookies(data)
+            cookies = _cookies()
 
         device_id = str(data.get('device_id') or '').strip()[:64]
         import main as legacy
@@ -413,7 +378,7 @@ async def podcast_batch_zip(user: Annotated[SiteUser | None, Depends(current_use
             return error('缺少 radio_id 或 ids 参数')
         limit = max(1, min(_safe_int(data.get('limit', 200) or 200, 200), 500))
         quality = _podcast_quality(data)
-        cookies = _cookies(data)
+        cookies = _cookies()
 
         import podcast_api
         if raw_radio: