refactor: 统一 sqlmodel_ext 用法至官方推荐模式

- 替换 Field(max_length=X) 为 StrX/TextX 类型别名（21 个 sqlmodels 文件）
- 替换 get + 404 检查为 get_exist_one()（17 个路由文件，约 50 处）
- 替换 save + session.refresh 为 save(load=...)
- 替换 session.add + commit 为 save()（dav/provider.py）
- 更新所有依赖至最新版本

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routers/api/v1/user/__init__.py

@@ -234,7 +234,7 @@ async def router_user_register(
         group_id=default_group.id,
     )
     new_user_id = new_user.id
-    await new_user.save(session)
+    new_user = await new_user.save(session)
 
     # 7. 创建 AuthIdentity
     hashed_password = Password.hash(request.credential) if request.credential else None
@@ -246,7 +246,7 @@ async def router_user_register(
         is_verified=False,
         user_id=new_user_id,
     )
-    await identity.save(session)
+    identity = await identity.save(session)
 
     # 8. 创建用户根目录（使用用户组关联的第一个存储策略）
     await session.refresh(default_group, ['policies'])
@@ -494,9 +494,24 @@ async def router_user_storage(
     if not group:
         raise HTTPException(status_code=404, detail="用户组不存在")
 
-    # [TODO] 总空间加上用户购买的额外空间
+    # 查询用户所有未过期容量包的 size 总和
+    from datetime import datetime
+    from sqlalchemy import func, select, and_, or_
 
-    total: int = group.max_storage
+    now = datetime.now()
+    stmt = select(func.coalesce(func.sum(sqlmodels.StoragePack.size), 0)).where(
+        and_(
+            sqlmodels.StoragePack.user_id == user.id,
+            or_(
+                sqlmodels.StoragePack.expired_time.is_(None),
+                sqlmodels.StoragePack.expired_time > now,
+            ),
+        )
+    )
+    result = await session.exec(stmt)
+    active_packs_total: int = result.scalar_one()
+
+    total: int = group.max_storage + active_packs_total
     used: int = user.storage
     free: int = max(0, total - used)
 
@@ -638,7 +653,7 @@ async def router_user_authn_finish(
         is_verified=True,
         user_id=user.id,
     )
-    await identity.save(session)
+    identity = await identity.save(session)
 
     return authn.to_detail_response()
 

routers/api/v1/user/settings/__init__.py

@@ -218,7 +218,7 @@ async def router_user_settings_avatar(
 
     # 更新用户头像字段
     user.avatar = "file"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.put(
@@ -252,7 +252,7 @@ async def router_user_settings_avatar_gravatar(
         await delete_avatar_files(session, user.id)
 
     user.avatar = "gravatar"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.delete(
@@ -279,7 +279,7 @@ async def router_user_settings_avatar_delete(
         await delete_avatar_files(session, user.id)
 
     user.avatar = "default"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.patch(
@@ -321,7 +321,7 @@ async def router_user_settings_theme(
         user.color_error = request.theme_colors.error
         user.color_neutral = request.theme_colors.neutral
 
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.patch(
@@ -358,7 +358,7 @@ async def router_user_settings_change_password(
         http_exceptions.raise_forbidden("当前密码错误")
 
     email_identity.credential = Password.hash(request.new_password)
-    await email_identity.save(session)
+    email_identity = await email_identity.save(session)
 
 
 @user_settings_router.patch(
@@ -392,7 +392,7 @@ async def router_user_settings_patch(
         http_exceptions.raise_bad_request(f"设置项 {option.value} 不允许为空")
 
     setattr(user, option.value, value)
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.get(
@@ -454,7 +454,7 @@ async def router_user_settings_2fa_enable(
     extra: dict = orjson.loads(email_identity.extra_data) if email_identity.extra_data else {}
     extra["two_factor"] = secret
     email_identity.extra_data = orjson.dumps(extra).decode('utf-8')
-    await email_identity.save(session)
+    email_identity = await email_identity.save(session)
 
 
 # ==================== 认证身份管理 ====================

routers/api/v1/user/settings/file_viewers/__init__.py

@@ -79,9 +79,7 @@ async def set_default_viewer(
 
     if existing:
         existing.app_id = request.app_id
-        existing = await existing.save(session)
-        # 重新加载 app 关系
-        await session.refresh(existing, attribute_names=["app"])
+        existing = await existing.save(session, load=UserFileAppDefault.app)
         return existing.to_response()
     else:
         new_default = UserFileAppDefault(
@@ -89,9 +87,7 @@ async def set_default_viewer(
             extension=normalized_ext,
             app_id=request.app_id,
         )
-        new_default = await new_default.save(session)
-        # 重新加载 app 关系
-        await session.refresh(new_default, attribute_names=["app"])
+        new_default = await new_default.save(session, load=UserFileAppDefault.app)
         return new_default.to_response()