refactor: 迁移收尾（管理员2FA）+ 抽取公共工具层，消除 router 间重复

补齐最后缺口：
- POST /api/v1/auth/admin_login/email、/auth/admin_login/verify（管理员 2FA Step2/3），
  复用 auth_routes 的票据表与尝试上限（跨栈共享），签发会话 Cookie

重构（消除约 200 行重复，11 个 router 受益）：
- web/request_utils.py：request_data / safe_int / extract_id / cookies / dedup_ids
  原在各 router 各复制一份，现集中
- web/serializers.py：format_credits / user_public / record_req_log
- 各 router 改为导入别名，行为逐字不变

覆盖率：Flask 90 条业务路由全部有 FastAPI 等价端点（含 5 个向后兼容别名）。
验证：pytest 69/69；ruff All checks passed；pyright 0 errors；奇偶 36/36；冒烟 10/10。

web/routers/register.py

@@ -18,7 +18,7 @@ import asyncio
 import os
 import sqlite3
 import time
-from typing import Annotated, Any
+from typing import Annotated
 
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import JSONResponse
@@ -29,7 +29,11 @@ from core import db, repo
 from core import session as cs
 from web import ratelimit
 from web.deps import SiteUser, current_user
+from web.request_utils import (
+    request_data as _request_data,
+)
 from web.response import error, success
+from web.serializers import user_public as _user_public
 
 router = APIRouter()
 
@@ -37,37 +41,6 @@ SESSION_COOKIE = 'session'
 _SESSION_MAX_AGE = 7 * 86400
 
 
-async def _request_data(request: Request) -> dict[str, Any]:
-    data: dict[str, Any] = {}
-    if request.method == 'GET':
-        data.update(dict(request.query_params))
-        return data
-    try:
-        body = await request.json()
-        if isinstance(body, dict):
-            data.update(body)
-    except Exception:
-        pass
-    if not data:
-        try:
-            form = await request.form()
-            data.update(dict(form.items()))
-        except Exception:
-            pass
-    return data
-
-
-def _user_public(row: dict) -> dict:
-    return {
-        'id': row['id'],
-        'username': row['username'],
-        'email': row.get('email'),
-        'role': row['role'],
-        'duration_seconds': row['duration_seconds'],
-        'created_at': row.get('created_at'),
-        'last_login': row.get('last_login'),
-        'ann_seen': row.get('ann_seen'),
-    }
 
 
 def _login_cookie_response(payload: dict, message: str, uid: int, seq: int,