feat: one account can bind both netease + skin identities

- db: user_identities table (UNIQUE user_id+source), migrate backfill from users
- auth: GET/POST/DELETE /api/auth/identities - bind/unbind/list identities
  (netease requires UID, one per source, name uniqueness, keep >=1)
- register/external/plugin/admin-created users auto-write primary identity
- tickets: submit uses selected identity (validated belongs to user)
- dashboard: 我的身份 card with bind/unbind UI
- ticket-create: identity selector when >1 identity

public/js/pages/dashboard.js

@@ -16,13 +16,15 @@ const Dashboard = {
         Auth.isOwner() ? API.get('/export/dashboard') : null,
       ]);
       const bans = Auth.isAdmin() ? await API.get('/bans/active').catch(()=>[]) : [];
-      this.renderContent(ct, stats, exports, bans);
+      const identities = await API.get('/auth/identities').catch(()=>[]);
+      this.renderContent(ct, stats, exports, bans, identities);
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }
   },
 
-  renderContent(ct, stats, exports, bans) {
+  renderContent(ct, stats, exports, bans, identities) {
     const byStatus = stats.byStatus || {};
     const banData = bans || [];
+    const idents = identities || [];
 
     ct.innerHTML = `
       <div class="stats-grid">
@@ -37,6 +39,18 @@ const Dashboard = {
         <div class="card-b">${banData.length === 0 ? '<span class="tm">暂无封禁记录</span>' : `<table><thead><tr><th>玩家</th><th>类型</th><th>原因</th><th>时长</th><th>时间</th></tr></thead><tbody>${banData.map(b=>`<tr><td>${U.esc(b.player_name)}</td><td>${b.type==='ban'?'封禁':b.type==='mute'?'禁言':'其他'}</td><td class="ts">${U.esc(b.reason||'')}</td><td>${b.duration||'永久'}</td><td class="ts">${U.date(b.created_at)}</td></tr>`).join('')}</tbody></table>`}</div>
       </div>` : ''}
 
+      <div class="card"><div class="card-h"><i class="fas fa-id-card"></i> 我的身份 ${idents.length < 2 ? `<button class="btn btn-p btn-sm" onclick="Dashboard.showAddIdentity()">绑定${idents.length === 1 ? '另一来源' : '身份'}</button>` : ''}</div>
+        <div class="card-b">
+          ${idents.length === 0 ? '<span class="tm">暂无身份，点击右上角绑定</span>' : `<table><thead><tr><th>来源</th><th>游戏名</th><th>UID</th><th>绑定时间</th><th>操作</th></tr></thead><tbody>${idents.map(it=>`<tr>
+            <td><span class="badge bg-${it.source==='netease'?'processing':'admin'}">${it.source==='netease'?'网易端':'皮肤站'}</span></td>
+            <td>${U.esc(it.game_name)}</td><td class="ts">${U.esc(it.game_uid||'-')}</td>
+            <td class="ts">${U.date(it.created_at)}</td>
+            <td>${idents.length > 1 ? `<button class="btn btn-d btn-sm" onclick="Dashboard.removeIdentity(${it.id})"><i class="fas fa-unlink"></i> 解绑</button>` : '<span class="tm ts">主身份</span>'}</td>
+          </tr>`).join('')}</tbody></table>`}
+          <p class="tm ts mt-4"><i class="fas fa-info-circle"></i> 同一账号可同时绑定网易端与皮肤站身份，提交工单时选择使用哪个身份。</p>
+        </div>
+      </div>
+
       ${Auth.isOwner() && exports ? `
       <div class="grid-2">
         <div class="card"><div class="card-h">类型分布</div><div class="card-b">
@@ -73,6 +87,45 @@ const Dashboard = {
     setTimeout(() => Dashboard.checkMinDuration(), 100);
   },
 
+  showAddIdentity() {
+    U.modal('绑定身份', `
+      <form id="ident-form">
+        <div class="form-group"><label>来源</label><select id="ident-source"><option value="netease">网易端</option><option value="skin">皮肤站</option></select></div>
+        <div class="form-group"><label>游戏名 *</label><input id="ident-name" required placeholder="Minecraft ID"></div>
+        <div class="form-group" id="ident-uid-group"><label>网易UID</label><input id="ident-uid" placeholder="仅网易端必填"></div>
+        <div id="ident-err" class="alert alert-e hidden"></div>
+        <div class="modal-f"><button type="button" class="btn btn-o" onclick="App.closeModal()">取消</button><button type="submit" class="btn btn-p">绑定</button></div>
+      </form>
+    `);
+    document.getElementById('ident-source').onchange = () => {
+      const isNetease = document.getElementById('ident-source').value === 'netease';
+      document.getElementById('ident-uid-group').style.display = isNetease ? '' : 'none';
+      document.getElementById('ident-uid').required = isNetease;
+    };
+    document.getElementById('ident-form').onsubmit = async e => {
+      e.preventDefault();
+      try {
+        await API.post('/auth/identities', {
+          source: document.getElementById('ident-source').value,
+          game_name: document.getElementById('ident-name').value,
+          game_uid: document.getElementById('ident-uid').value,
+        });
+        App.closeModal();
+        this.mount();
+      } catch (ex) {
+        const el = document.getElementById('ident-err');
+        el.textContent = ex.message;
+        el.classList.remove('hidden');
+      }
+    };
+  },
+
+  async removeIdentity(id) {
+    if (!await U.confirm('确认解绑该身份？')) return;
+    try { await API.delete(`/auth/identities/${id}`); this.mount(); }
+    catch (ex) { alert(ex.message); }
+  },
+
   async checkMinDuration() {
     const name = document.getElementById('ban-name')?.value;
     const uid = document.getElementById('ban-uid')?.value;