feat(backend): record lastLoginAt/IP/location on every login

Add lastLoginAt, lastLoginIp, lastLoginLocation to User schema. recordLogin() method called from all 5 login flows (phone, email, wx, password, register). Exposed in safeUser so info endpoint returns login metadata.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/src/modules/user/user.controller.ts

@@ -18,8 +18,8 @@ export class UserController {
   @Public()
   @Post('login')
   @HttpCode(HttpStatus.OK)
-  async login(@Body('phone') phone: string, @Body('code') code: string) {
-    return this.userService.loginByPhone(phone, code)
+  async login(@Body('phone') phone: string, @Body('code') code: string, @Req() req) {
+    return this.userService.loginByPhone(phone, code, req.ip)
   }
 
   // 📧 邮箱验证码登录（H5 用）
@@ -41,32 +41,32 @@ export class UserController {
   @Public()
   @Post('email-login')
   @HttpCode(HttpStatus.OK)
-  async emailLogin(@Body('email') email: string, @Body('code') code: string) {
-    return this.userService.loginByEmail(email, code)
+  async emailLogin(@Body('email') email: string, @Body('code') code: string, @Req() req) {
+    return this.userService.loginByEmail(email, code, req.ip)
   }
 
   // 密码登录
   @Public()
   @Post('password-login')
   @HttpCode(HttpStatus.OK)
-  async passwordLogin(@Body('email') email: string, @Body('password') password: string) {
-    return this.userService.loginByPassword(email, password)
+  async passwordLogin(@Body('email') email: string, @Body('password') password: string, @Req() req) {
+    return this.userService.loginByPassword(email, password, req.ip)
   }
 
   // 邮箱+密码注册
   @Public()
   @Post('register')
   @HttpCode(HttpStatus.OK)
-  async register(@Body('email') email: string, @Body('password') password: string) {
-    return this.userService.registerWithPassword(email, password)
+  async register(@Body('email') email: string, @Body('password') password: string, @Req() req) {
+    return this.userService.registerWithPassword(email, password, req.ip)
   }
 
   // 微信静默登录
   @Public()
   @Post('wx-login')
   @HttpCode(HttpStatus.OK)
-  async wxLogin(@Body('code') code: string) {
-    return this.userService.loginByWx(code)
+  async wxLogin(@Body('code') code: string, @Req() req) {
+    return this.userService.loginByWx(code, undefined, req.ip)
   }
 
   @Get('info')