refactor: 统一 sqlmodel_ext 用法至官方推荐模式

- 替换 Field(max_length=X) 为 StrX/TextX 类型别名（21 个 sqlmodels 文件）
- 替换 get + 404 检查为 get_exist_one()（17 个路由文件，约 50 处）
- 替换 save + session.refresh 为 save(load=...)
- 替换 session.add + commit 为 save()（dav/provider.py）
- 更新所有依赖至最新版本

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routers/api/v1/user/settings/__init__.py

@@ -218,7 +218,7 @@ async def router_user_settings_avatar(
 
     # 更新用户头像字段
     user.avatar = "file"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.put(
@@ -252,7 +252,7 @@ async def router_user_settings_avatar_gravatar(
         await delete_avatar_files(session, user.id)
 
     user.avatar = "gravatar"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.delete(
@@ -279,7 +279,7 @@ async def router_user_settings_avatar_delete(
         await delete_avatar_files(session, user.id)
 
     user.avatar = "default"
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.patch(
@@ -321,7 +321,7 @@ async def router_user_settings_theme(
         user.color_error = request.theme_colors.error
         user.color_neutral = request.theme_colors.neutral
 
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.patch(
@@ -358,7 +358,7 @@ async def router_user_settings_change_password(
         http_exceptions.raise_forbidden("当前密码错误")
 
     email_identity.credential = Password.hash(request.new_password)
-    await email_identity.save(session)
+    email_identity = await email_identity.save(session)
 
 
 @user_settings_router.patch(
@@ -392,7 +392,7 @@ async def router_user_settings_patch(
         http_exceptions.raise_bad_request(f"设置项 {option.value} 不允许为空")
 
     setattr(user, option.value, value)
-    await user.save(session)
+    user = await user.save(session)
 
 
 @user_settings_router.get(
@@ -454,7 +454,7 @@ async def router_user_settings_2fa_enable(
     extra: dict = orjson.loads(email_identity.extra_data) if email_identity.extra_data else {}
     extra["two_factor"] = secret
     email_identity.extra_data = orjson.dumps(extra).decode('utf-8')
-    await email_identity.save(session)
+    email_identity = await email_identity.save(session)
 
 
 # ==================== 认证身份管理 ====================

routers/api/v1/user/settings/file_viewers/__init__.py

@@ -79,9 +79,7 @@ async def set_default_viewer(
 
     if existing:
         existing.app_id = request.app_id
-        existing = await existing.save(session)
-        # 重新加载 app 关系
-        await session.refresh(existing, attribute_names=["app"])
+        existing = await existing.save(session, load=UserFileAppDefault.app)
         return existing.to_response()
     else:
         new_default = UserFileAppDefault(
@@ -89,9 +87,7 @@ async def set_default_viewer(
             extension=normalized_ext,
             app_id=request.app_id,
         )
-        new_default = await new_default.save(session)
-        # 重新加载 app 关系
-        await session.refresh(new_default, attribute_names=["app"])
+        new_default = await new_default.save(session, load=UserFileAppDefault.app)
         return new_default.to_response()