fix(auth): decouple managed login phones from company contacts

auth/src/main/java/com/baiyue/auth/controller/AuthController.java

@@ -77,7 +77,7 @@ public class AuthController {
     @SecurityRequirements
     @PostMapping("/register")
     @Operation(summary = "Merchant registration / 客户注册",
-            description = "Create a login account and an enterprise profile awaiting the required business license and legal-person ID; other qualification files are optional.")
+            description = "Create a login account and enterprise profile. The supplied phone initializes both the first administrator login phone and company contact phone; they are maintained independently after creation. Only the business license and unified social credit code are required for review; legal-person ID is optional.")
     public ApiResponse<MerchantRegisterResponse> register(@Valid @RequestBody MerchantRegisterRequest request) {
         return ApiResponse.success(registrationService.register(request));
     }

auth/src/main/java/com/baiyue/auth/dto/AccountManagementDtos.java

@@ -45,7 +45,7 @@ public final class AccountManagementDtos {
             @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
             @NotBlank String currentPassword) { }
     public record UpdateAccountPhoneRequest(
-            @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone) { }
+            @Pattern(regexp = "^1[3-9]\\d{9}$") String phone) { }
     public record UpdateAccountProfileRequest(@NotBlank @Size(max = 64) String displayName) { }
     public record UpdateAccountStatusRequest(@NotBlank String status) { }
     public record RevokeAccountSessionsRequest(

auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterRequest.java

@@ -1,10 +1,10 @@
 package com.baiyue.auth.dto;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Pattern;
 import jakarta.validation.constraints.Size;
-import io.swagger.v3.oas.annotations.media.Schema;
 
 @Schema(name = "MerchantRegisterRequest", description = "Phase-one merchant account registration")
 public record MerchantRegisterRequest(

auth/src/main/java/com/baiyue/auth/service/AccountManagementService.java

@@ -151,9 +151,9 @@ public class AccountManagementService {
             description = "同步受管账号手机号", captureAfter = false)
     public void updatePhone(Long accountId, UpdateAccountPhoneRequest request) {
         AuthAccount account = required(accountId);
-        String phone = request.phone().trim();
+        String phone = request.phone() == null ? null : request.phone().trim();
         if (Objects.equals(account.getPhone(), phone)) return;
-        if (repository.existsByPhoneForOtherAccount(phone, accountId)) {
+        if (phone != null && repository.existsByPhoneForOtherAccount(phone, accountId)) {
             throw new BizException(ResultCode.CONFLICT, "手机号已存在");
         }
         account.setPhone(phone);

auth/src/test/java/com/baiyue/auth/service/AccountManagementServiceTest.java

@@ -4,6 +4,7 @@ import com.baiyue.auth.dto.AccountManagementDtos.ChangePasswordRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.ForcedPasswordChangeRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.CreateAccountRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountProfileRequest;
+import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountPhoneRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountStatusRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountScopeRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.ChangeLoginIdentifiersRequest;
@@ -173,6 +174,17 @@ class AccountManagementServiceTest {
         verify(sessions).revokeAll(10L);
     }
 
+    @Test void managedPhoneChangeOrRemovalRevokesOnlyThatAccountsSessions() {
+        account.setPhone("13800138000");
+
+        service.updatePhone(10L, new UpdateAccountPhoneRequest(null));
+
+        assertEquals(null, account.getPhone());
+        assertEquals(3, account.getTokenVersion());
+        verify(repository).save(account);
+        verify(sessions).revokeAll(10L);
+    }
+
     @Test void duplicatePhoneDoesNotChangeLoginIdentifiers() {
         account.setUsername("old.user");
         account.setPhone("13800138000");