fix(api): 禁用用户与吊销会话合为一个事务，passkey 签名计数只增不减，引导检查遇到数据库故障返回 503

internal/api/api_test.go

@@ -583,7 +583,7 @@ func (f *fakeRepo) DeleteAllPasskeyCredentialsForUser(_ context.Context, userID
 func (f *fakeRepo) AdvanceCredentialSignCount(_ context.Context, credentialID string, newSignCount uint32, usedAt time.Time) error {
 	for id, c := range f.passkeyCreds {
 		if c.CredentialID == credentialID {
-			c.SignCount = newSignCount
+			c.SignCount = max(c.SignCount, newSignCount)
 			t := usedAt
 			c.LastUsedAt = &t
 			f.passkeyCreds[id] = c