refactor(android): 改用设备签名拦截器认证，移除 challenge 往返

设备接口统一由 AuthInterceptor 注入 Device-Sig 头完成认证，删除手动 challenge 签名流程与 transport-key 接口，注册改用本地生成 ts:nonce 做 PoP 验签。

springboot-server/src/main/java/com/secure/demo/config/WebConfig.java

@@ -3,6 +3,7 @@ package com.secure.demo.config;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 import java.util.Arrays;
@@ -40,10 +41,12 @@ public class WebConfig implements WebMvcConfigurer {
                     + "http://localhost:5173,http://127.0.0.1:5173";
 
     private final List<String> allowedOrigins;
+    private final DeviceAuthInterceptor deviceAuthInterceptor;
 
     public WebConfig(
             @Value("${app.cors.allowed-origins:}") String configuredOrigins,
-            @Value("${APP_CORS_ALLOWED_ORIGINS:}") String envOrigins) {
+            @Value("${APP_CORS_ALLOWED_ORIGINS:}") String envOrigins,
+            DeviceAuthInterceptor deviceAuthInterceptor) {
         String raw = (envOrigins != null && !envOrigins.isBlank()) ? envOrigins : configuredOrigins;
         if (raw == null || raw.isBlank()) {
             raw = DEFAULT_ALLOWED_ORIGINS;
@@ -52,6 +55,20 @@ public class WebConfig implements WebMvcConfigurer {
                 .map(String::trim)
                 .filter(s -> !s.isEmpty())
                 .collect(Collectors.toList());
+        this.deviceAuthInterceptor = deviceAuthInterceptor;
+    }
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        // 设备签名认证拦截器：仅拦截需要设备认证的路径（/api/device/**、/api/photo/**），
+        // 显式排除公开接口（注册、登录、健康检查、CORS 预检）。
+        registry.addInterceptor(deviceAuthInterceptor)
+                .addPathPatterns("/api/device/**", "/api/photo/**")
+                .excludePathPatterns(
+                        "/api/device/register",          // 注册：设备未入库，用请求内公钥做 PoP 验签
+                        "/api/photo/{photoId}/decrypt",  // Web 用户端 Bearer 鉴权，非设备签名
+                        "/api/photo/{photoId}/decrypt/stream"
+                );
     }
 
     @Override