docs: add Swagger annotations to 5 handlers

Add comprehensive Swagger/Swagger comments to:
- export_handler.go (ExportUsers, ImportUsers, GetImportTemplate)
- sms_handler.go (SendCode, LoginByCode)
- sso_handler.go (Authorize, Token, Introspect, Revoke, UserInfo)
- theme_handler.go (8 endpoints)
- webhook_handler.go (5 endpoints)

All 18 handlers now have Swagger annotations.

internal/api/handler/sms_handler.go

@@ -14,6 +14,16 @@ type SMSHandler struct {
 	smsCodeService *service.SMSCodeService
 }
 
+// SMSLoginRequest 短信登录请求
+type SMSLoginRequest struct {
+	Phone         string `json:"phone" binding:"required"`
+	Code          string `json:"code" binding:"required"`
+	DeviceID      string `json:"device_id"`
+	DeviceName    string `json:"device_name"`
+	DeviceBrowser string `json:"device_browser"`
+	DeviceOS      string `json:"device_os"`
+}
+
 // NewSMSHandler creates a new SMSHandler (stub, no SMS configured)
 func NewSMSHandler() *SMSHandler {
 	return &SMSHandler{}
@@ -27,7 +37,17 @@ func NewSMSHandlerWithService(authService *service.AuthService, smsCodeService *
 	}
 }
 
-// SendCode 发送短信验证码（用于注册/登录）
+// SendCode 发送短信验证码
+// @Summary 发送短信验证码
+// @Description 向指定手机号发送短信验证码（用于注册或登录）
+// @Tags 短信验证
+// @Accept json
+// @Produce json
+// @Param request body service.SendCodeRequest true "发送验证码请求"
+// @Success 200 {object} Response "发送成功"
+// @Failure 400 {object} Response "请求参数错误"
+// @Failure 503 {object} Response "短信服务未配置"
+// @Router /api/v1/sms/send [post]
 func (h *SMSHandler) SendCode(c *gin.Context) {
 	if h.smsCodeService == nil {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"code": 503, "message": "SMS service not configured"})
@@ -53,22 +73,25 @@ func (h *SMSHandler) SendCode(c *gin.Context) {
 	})
 }
 
-// LoginByCode 短信验证码登录（带设备信息以支持设备信任链路）
+// LoginByCode 短信验证码登录
+// @Summary 短信验证码登录
+// @Description 使用手机号和短信验证码登录（带设备信息以支持设备信任链路）
+// @Tags 短信验证
+// @Accept json
+// @Produce json
+// @Param request body SMSLoginRequest true "登录请求"
+// @Success 200 {object} Response "登录成功"
+// @Failure 400 {object} Response "请求参数错误"
+// @Failure 401 {object} Response "验证码错误"
+// @Failure 503 {object} Response "短信登录未配置"
+// @Router /api/v1/sms/login [post]
 func (h *SMSHandler) LoginByCode(c *gin.Context) {
 	if h.authService == nil {
 		c.JSON(http.StatusServiceUnavailable, gin.H{"code": 503, "message": "SMS login not configured"})
 		return
 	}
 
-	var req struct {
-		Phone         string `json:"phone" binding:"required"`
-		Code          string `json:"code" binding:"required"`
-		DeviceID      string `json:"device_id"`
-		DeviceName    string `json:"device_name"`
-		DeviceBrowser string `json:"device_browser"`
-		DeviceOS      string `json:"device_os"`
-	}
-
+	var req SMSLoginRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
 		return