feat(auth): add comprehensive authentication system with 2FA support

- Add new auth module with captcha, login, logout, register, and email verification endpoints
- Implement two-factor authentication with TOTP enable, disable, verify, and backup codes regeneration
- Create RSA public key endpoint for secure password encryption
- Add user profile management with get current user and email retrieval
- Integrate OpenAPI documentation for all authentication endpoints
- Implement password reset functionality with email verification flow
- Add comprehensive API response structures with proper error handling
- Configure all auth routes under /api/v1/auth scope with proper tagging

api/auth/request_email_change.rs

@@ -0,0 +1,39 @@
+use actix_web::{HttpResponse, web};
+
+use crate::api::response::{ApiEmptyResponse, ApiErrorResponse};
+use crate::error::AppError;
+use crate::service::AppService;
+use crate::service::auth::email::EmailChangeRequest;
+use crate::session::Session;
+
+#[utoipa::path(
+    post,
+    path = "/api/v1/auth/email/change",
+    tag = "Auth",
+    operation_id = "authRequestEmailChange",
+    summary = "Request login email change",
+    description = "After verifying the current user password, send a confirmation link to the new email address. password must be encrypted with the current session RSA public key. The token in the confirmation link is valid for 1 hour by default; the actual email switch is completed by calling /auth/email/verify.",
+    request_body(
+        content = EmailChangeRequest,
+        description = "The new email address and encrypted current account password.",
+        content_type = "application/json"
+    ),
+    responses(
+        (status = 200, description = "The confirmation email has been queued for delivery.", body = ApiEmptyResponse),
+        (status = 400, description = "The new email is empty, the password is incorrect, or RSA decryption failed.", body = ApiErrorResponse),
+        (status = 401, description = "The current session is not authenticated.", body = ApiErrorResponse),
+        (status = 409, description = "The new email is already in use.", body = ApiErrorResponse),
+        (status = 500, description = "Cache, email service, or database read failed.", body = ApiErrorResponse)
+    )
+)]
+pub async fn handle(
+    service: web::Data<AppService>,
+    session: Session,
+    params: web::Json<EmailChangeRequest>,
+) -> Result<HttpResponse, AppError> {
+    service
+        .auth
+        .auth_email_change_request(&session, params.into_inner())
+        .await?;
+    Ok(HttpResponse::Ok().json(ApiEmptyResponse::ok("email change verification sent")))
+}