iam: request bodies for oauth/mfa/verification/ldap/unlink/webhook write ops
Sourced from the real controllers (controllers/*.go, object/*.go, form/*.go):
oauth token/refresh (TokenRequest, optional), callback+logout (form, optional),
check-password (object.User subset), mfa setup enable/initiate/verify + preferred
(form), reset-contact, verification-code send/verify, captcha/verify, ldap/sync
([]object.LdapUser), unlink (LinkForm), webhook (WeChat XML). Reuses existing
object.User / object.LdapUser. Stale Casdoor-era ops (user-keys, order/pay/place/
invoice, refresh-engines) left unauthored — no live handler.
zeekay
bb2e6bf8d3