refactor: close transactional boundary debt batch

app/api/endpoints/mfa.py

@@ -101,7 +101,11 @@ def _verify_passkey_and_update(
     )
 
     if success:
-        service.update_last_used(passkey, new_sign_count)
+        success = service.compare_and_update_sign_count(
+            passkey_id=passkey.id,
+            expected_sign_count=int(passkey.sign_count or 0),
+            sign_count=new_sign_count,
+        )
 
     return success, new_sign_count
 
@@ -142,16 +146,11 @@ async def mfa_status(
     service: UserService = Depends(get_user_service),
 ) -> Any:
     """
-    检查指定用户是否启用了二次验证
+    检查指定启用用户是否开启 OTP，并隐藏账号不存在或禁用状态。
     """
     user = await service.get_by_name(username)
-    if not user:
-        return _SchemaResponse(success=False, message="用户不存在")
-
-    # 检查是否启用了OTP
-    has_otp = user.is_otp
-
-    return _SchemaResponse(success=True, data={"enabled": bool(has_otp)})
+    has_otp = bool(user and user.is_active and user.is_otp)
+    return _SchemaResponse(success=True, data={"enabled": has_otp})
 
 
 # ==================== OTP 相关接口 ====================