test: add comprehensive test coverage and improve code quality

- Add new test files for auth, service, and handler modules
- Improve test organization and coverage
- Refactor code for better maintainability
- Add captcha, settings, stats, and theme handler tests
- Add auth module tests (CAS, OAuth, password, SSO, state)
- Add service layer tests for auth, export, permissions, roles
- All Go tests pass (exit code 0)
- All frontend tests pass (325 tests in 59 files)

internal/api/handler/sms_handler.go

@@ -24,13 +24,9 @@ type SMSLoginRequest struct {
 	DeviceOS      string `json:"device_os"`
 }
 
-// NewSMSHandler creates a new SMSHandler (stub, no SMS configured)
-func NewSMSHandler() *SMSHandler {
-	return &SMSHandler{}
-}
-
-// NewSMSHandlerWithService creates a SMSHandler backed by real AuthService + SMSCodeService
-func NewSMSHandlerWithService(authService *service.AuthService, smsCodeService *service.SMSCodeService) *SMSHandler {
+// NewSMSHandler creates a SMSHandler backed by AuthService + SMSCodeService.
+// If both services are nil, the handler will return 503 for all requests.
+func NewSMSHandler(authService *service.AuthService, smsCodeService *service.SMSCodeService) *SMSHandler {
 	return &SMSHandler{
 		authService:    authService,
 		smsCodeService: smsCodeService,