fix: preserve Android negotiated layer

internal/store/authorization.go

@@ -10,6 +10,7 @@ import (
 type AuthorizationStore interface {
 	Bind(ctx context.Context, a domain.Authorization) error
 	ByAuthKey(ctx context.Context, authKeyID [8]byte) (domain.Authorization, bool, error)
+	UpdateLayer(ctx context.Context, authKeyID [8]byte, layer int) error
 	ListByUser(ctx context.Context, userID int64) ([]domain.Authorization, error)
 	Delete(ctx context.Context, authKeyID [8]byte) error
 	DeleteByHash(ctx context.Context, userID, hash int64) (domain.Authorization, bool, error)

internal/store/memory/auth.go

@@ -158,6 +158,20 @@ func (s *AuthorizationStore) ByAuthKey(_ context.Context, id [8]byte) (domain.Au
 	return a, ok, nil
 }
 
+func (s *AuthorizationStore) UpdateLayer(_ context.Context, id [8]byte, layer int) error {
+	if layer <= 0 {
+		return nil
+	}
+	s.mu.Lock()
+	if a, ok := s.m[id]; ok {
+		a.Layer = layer
+		a.ActiveAt = time.Now()
+		s.m[id] = a
+	}
+	s.mu.Unlock()
+	return nil
+}
+
 func (s *AuthorizationStore) MarkPasswordPassed(_ context.Context, id [8]byte) error {
 	s.mu.Lock()
 	if a, ok := s.m[id]; ok {

internal/store/postgres/authorization.go

@@ -68,6 +68,18 @@ FROM authorizations WHERE auth_key_id = $1`, authKeyIDToInt64(id))
 	return a, true, nil
 }
 
+func (s *AuthorizationStore) UpdateLayer(ctx context.Context, id [8]byte, layer int) error {
+	if layer <= 0 {
+		return nil
+	}
+	if _, err := s.db.Exec(ctx, `
+UPDATE authorizations SET layer = $2, active_at = now() WHERE auth_key_id = $1`,
+		authKeyIDToInt64(id), int32(layer)); err != nil {
+		return fmt.Errorf("update authorization layer: %w", err)
+	}
+	return nil
+}
+
 // MarkPasswordPassed 在两步验证通过后清除 password_pending，使 auth_key 转为完全授权。
 func (s *AuthorizationStore) MarkPasswordPassed(ctx context.Context, id [8]byte) error {
 	if _, err := s.db.Exec(ctx, `