refactor: migrate passkey host queries

tests/fixtures/architecture/transaction-debt-baseline.json

@@ -3,10 +3,10 @@
     "by_kind": {
       "async_db_query": 49,
       "async_db_update": 0,
-      "db_query": 72,
+      "db_query": 70,
       "db_update": 0
     },
-    "count": 121,
+    "count": 119,
     "methods": [
       {
         "decorator": "async_db_query",
@@ -188,21 +188,11 @@
         "file": "app/db/models/passkey.py",
         "method": "PassKey.async_get_by_user_id"
       },
-      {
-        "decorator": "db_query",
-        "file": "app/db/models/passkey.py",
-        "method": "PassKey.get_by_credential_id"
-      },
       {
         "decorator": "db_query",
         "file": "app/db/models/passkey.py",
         "method": "PassKey.get_by_id"
       },
-      {
-        "decorator": "db_query",
-        "file": "app/db/models/passkey.py",
-        "method": "PassKey.get_by_user_id"
-      },
       {
         "decorator": "async_db_query",
         "file": "app/db/models/plugindata.py",

tests/test_db_config_user_queries.py

@@ -212,6 +212,21 @@ def test_passkey_listing_excludes_inactive_credentials(db):
         {"cred-active-1", "cred-active-2"}
 
 
+def test_passkey_oper_queries_use_explicit_session(db, monkeypatch):
+    """PassKeyOper 的宿主查询使用调用方 Session，不创建兼容事务。"""
+    db.add(_passkey(9002, "cred-oper"), _passkey(9002, "cred-oper-inactive", is_active=False))
+    monkeypatch.setattr(
+        "app.db.oper.passkey.run_sync_transaction",
+        lambda _query: pytest.fail("显式 Session 查询不应创建兼容事务"),
+    )
+
+    oper = PassKeyOper(db.session)
+
+    assert [item.credential_id for item in oper.list_by_user_id(9002)] == ["cred-oper"]
+    assert oper.get_by_credential_id("cred-oper").user_id == 9002
+    assert oper.get_by_credential_id("cred-oper-inactive") is None
+
+
 def test_passkey_lookup_by_credential_id_skips_inactive(db):
     """
     按凭据 ID 查找同样必须忽略停用记录，否则停用的密钥仍可完成认证。