refactor(controllers/web): dep-inject login and forgot-password payloads (#36659) - #40856

Summary

#36659

Extends the @model_validate dependency-injection decorator to the remaining web auth handlers that still parsed their Pydantic schema inline from web_ns.payload / request.args:

• ForgotPasswordSendEmailApi.post, ForgotPasswordCheckApi.post, ForgotPasswordResetApi.post (controllers/web/forgot_password.py)
• LoginApi.post, LoginStatusApi.get, EmailCodeLoginSendEmailApi.post, EmailCodeLoginApi.post (controllers/web/login.py)

Each handler now receives its validated query/payload model as a parameter via @model_validate(Schema). LoginApi.post and EmailCodeLoginApi.post keep @decrypt_password_field / @decrypt_code_field outside @model_validate, so decryption still runs before validation.

No behavior change: request parsing, validation errors, and response shapes are identical.

Testing

• uv run --project api pytest api/tests/unit_tests/controllers/web/test_web_forgot_password.py api/tests/unit_tests/controllers/web/test_web_login.py -o addopts= → 17 passed
• uv run --project api ruff check / ruff format --check on the two changed files → clean

Existing unit tests still drive the decorated handlers through Flask test_request_context, so they cover the decorator path rather than calling inspect.unwrap.

Screenshots

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran lint on the changed backend files. No frontend files changed.

From OpenCode