feat(ECR-010): Ops-E 系统运营；修复登出解绑；P2 Complete

落地管理员 RBAC/封禁/推送任务 stub，logout 解绑 device 并统一各页 ensureAccount，同时收口 P2 生日生成与状态文档。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/repository/auth_repo.go

@@ -116,6 +116,33 @@ func (r *AuthRepo) BindDevice(ctx context.Context, deviceKey string, userID uuid
 	return err
 }
 
+// RebindDeviceAnonymous creates a fresh anonymous user and points the device at it.
+// Used on logout so the device is no longer tied to the registered account (Spec R5).
+func (r *AuthRepo) RebindDeviceAnonymous(ctx context.Context, deviceKey string) error {
+	if deviceKey == "" {
+		return nil
+	}
+	tx, err := r.Pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+
+	var uid uuid.UUID
+	if err := tx.QueryRow(ctx, `INSERT INTO users DEFAULT VALUES RETURNING id`).Scan(&uid); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(ctx, `
+		INSERT INTO device_identities(device_key, user_id)
+		VALUES ($1,$2)
+		ON CONFLICT (device_key) DO UPDATE SET user_id=$2, updated_at=now(), deleted_at=NULL`,
+		deviceKey, uid,
+	); err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
 // CreateSession inserts a session token.
 func (r *AuthRepo) CreateSession(ctx context.Context, userID uuid.UUID, token string, expires time.Time) error {
 	_, err := r.Pool.Exec(ctx, `