diff --git a/internal/api/handler/auth_handler.go b/internal/api/handler/auth_handler.go
index b86a354..05bd9bc 100644
--- a/internal/api/handler/auth_handler.go
+++ b/internal/api/handler/auth_handler.go
@@ -200,32 +200,32 @@ func (h *AuthHandler) GetAuthCapabilities(c *gin.Context) {
 
 func (h *AuthHandler) OAuthLogin(c *gin.Context) {
 	provider := c.Param("provider")
-	c.JSON(http.StatusOK, gin.H{"provider": provider, "message": "OAuth not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "OAuth not configured", "data": gin.H{"provider": provider}})
 }
 
 func (h *AuthHandler) OAuthCallback(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"error": "OAuth not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "OAuth not configured"})
 }
 
 func (h *AuthHandler) OAuthExchange(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"error": "OAuth not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "OAuth not configured"})
 }
 
 func (h *AuthHandler) GetEnabledOAuthProviders(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"providers": []string{}})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "success", "data": gin.H{"providers": []string{}}})
 }
 
 func (h *AuthHandler) ActivateEmail(c *gin.Context) {
 	token := c.Query("token")
 	if token == "" {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "token is required"})
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": "token is required"})
 		return
 	}
 	if err := h.authService.ActivateEmail(c.Request.Context(), token); err != nil {
 		handleError(c, err)
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "email activated successfully"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "email activated successfully"})
 }
 
 func (h *AuthHandler) ResendActivationEmail(c *gin.Context) {
@@ -233,7 +233,7 @@ func (h *AuthHandler) ResendActivationEmail(c *gin.Context) {
 		Email string `json:"email" binding:"required,email"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
 		return
 	}
 	if err := h.authService.ResendActivationEmail(c.Request.Context(), req.Email); err != nil {
@@ -241,7 +241,7 @@ func (h *AuthHandler) ResendActivationEmail(c *gin.Context) {
 		return
 	}
 	// 防枚举：无论邮箱是否存在，统一返回成功
-	c.JSON(http.StatusOK, gin.H{"message": "activation email sent if address is registered"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "activation email sent if address is registered"})
 }
 
 func (h *AuthHandler) SendEmailCode(c *gin.Context) {
@@ -249,7 +249,7 @@ func (h *AuthHandler) SendEmailCode(c *gin.Context) {
 		Email string `json:"email" binding:"required,email"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
 		return
 	}
 
@@ -258,7 +258,7 @@ func (h *AuthHandler) SendEmailCode(c *gin.Context) {
 		handleError(c, err)
 		return
 	}
-	c.JSON(http.StatusOK, gin.H{"message": "验证码已发送"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "验证码已发送"})
 }
 
 func (h *AuthHandler) LoginByEmailCode(c *gin.Context) {
@@ -271,7 +271,7 @@ func (h *AuthHandler) LoginByEmailCode(c *gin.Context) {
 		DeviceOS      string `json:"device_os"`
 	}
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
 		return
 	}
 
@@ -311,19 +311,19 @@ func (h *AuthHandler) BootstrapAdmin(c *gin.Context) {
 	// P0 修复：BootstrapAdmin 端点需要 bootstrap secret 验证
 	bootstrapSecret := os.Getenv("BOOTSTRAP_SECRET")
 	if bootstrapSecret == "" {
-		c.JSON(http.StatusForbidden, gin.H{"error": "引导初始化未授权"})
+		c.JSON(http.StatusForbidden, gin.H{"code": 403, "message": "引导初始化未授权"})
 		return
 	}
 
 	providedSecret := c.GetHeader("X-Bootstrap-Secret")
 	if providedSecret == "" {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "缺少引导密钥"})
+		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "缺少引导密钥"})
 		return
 	}
 
 	// 使用恒定时间比较防止时序攻击
 	if subtle.ConstantTimeCompare([]byte(providedSecret), []byte(bootstrapSecret)) != 1 {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "引导密钥无效"})
+		c.JSON(http.StatusUnauthorized, gin.H{"code": 401, "message": "引导密钥无效"})
 		return
 	}
 
@@ -334,7 +334,7 @@ func (h *AuthHandler) BootstrapAdmin(c *gin.Context) {
 	}
 
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		c.JSON(http.StatusBadRequest, gin.H{"code": 400, "message": err.Error()})
 		return
 	}
 
@@ -359,39 +359,39 @@ func (h *AuthHandler) BootstrapAdmin(c *gin.Context) {
 }
 
 func (h *AuthHandler) SendEmailBindCode(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "email bind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "email bind not configured"})
 }
 
 func (h *AuthHandler) BindEmail(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "email bind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "email bind not configured"})
 }
 
 func (h *AuthHandler) UnbindEmail(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "email unbind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "email unbind not configured"})
 }
 
 func (h *AuthHandler) SendPhoneBindCode(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "phone bind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "phone bind not configured"})
 }
 
 func (h *AuthHandler) BindPhone(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "phone bind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "phone bind not configured"})
 }
 
 func (h *AuthHandler) UnbindPhone(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "phone unbind not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "phone unbind not configured"})
 }
 
 func (h *AuthHandler) GetSocialAccounts(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"accounts": []interface{}{}})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "success", "data": gin.H{"accounts": []interface{}{}}})
 }
 
 func (h *AuthHandler) BindSocialAccount(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "social binding not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "social binding not configured"})
 }
 
 func (h *AuthHandler) UnbindSocialAccount(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"message": "social unbinding not configured"})
+	c.JSON(http.StatusOK, gin.H{"code": 0, "message": "social unbinding not configured"})
 }
 
 func (h *AuthHandler) SupportsEmailCodeLogin() bool {