fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686)

1. Remember the last token that has been rotated and skip its validation
2. Don't alarm when the token mismatch occurs in a short window

modelmigration/migrations.go

@@ -434,6 +434,7 @@ func prepareMigrationTasks() []*migration {
 
 		newMigration(356, "Add index on action_run commit_sha", v29.AddActionRunCommitSHAIndex),
 		newMigration(357, "Normalize legacy team authorize values", v29.NormalizeLegacyTeamAuthorize),
+		newMigration(358, "Track previous remember-me token hashes", v29.AddPreviousAuthTokenHash),
 	}
 	return preparedMigrations
 }

modelmigration/v29/v358.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v29
+
+import (
+	"context"
+
+	"gitea.dev/modelmigration/base"
+	"gitea.dev/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+func AddPreviousAuthTokenHash(_ context.Context, x base.EngineMigration) error {
+	type AuthToken struct {
+		PreviousTokenHash string
+		RotatedUnix       timeutil.TimeStamp
+	}
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreDropIndices: true,
+		IgnoreConstrains:  true,
+	}, new(AuthToken))
+	return err
+}