bug fix

backend/routes.py

@@ -323,7 +323,10 @@ def api_reauth_webauthn_begin():
     if not stored_id:
         return jsonify({"error": "未注册 Passkey"}), 400
     try:
-        options = begin_authentication(request, allow_credential_ids=[stored_id])
+        options = begin_authentication(
+            request, allow_credential_ids=[stored_id],
+            challenge_key=f"reauth_{_cur()}",
+        )
         return jsonify(options)
     except Exception as e:
         return jsonify({"error": str(e)}), 500
@@ -347,6 +350,7 @@ def api_reauth_webauthn_complete():
             request, credential,
             stored_credential_id=stored_id,
             stored_public_key=stored_key,
+            challenge_key=f"reauth_{_cur()}",
         )
         if result.get("credential_id") != stored_id:
             return jsonify({"error": "Passkey 凭证不匹配"}), 401
@@ -1644,6 +1648,8 @@ def set_time_config():
     if not tz_str:
         return jsonify({"error": "timezone is required"}), 400
     if set_tz(tz_str):
+        # 广播给该用户的显示端，立即刷新（跨 worker 由 EventBus 远程广播保证）
+        current_app.event_bus.publish("timezone_changed", {"timezone": tz_str}, user_id=_cur())
         return jsonify({"ok": True})
     return jsonify({"error": f"时区 '{tz_str}' 无效，请使用 IANA 名称（如 Asia/Shanghai）或 UTC+X 格式"}), 400