feat: 全站登录保护，管理后台仅管理员可访问

- tasks 路由级认证保护，所有 API 需登录
- 未登录时显示登录页面，不暴露导航和功能
- ConfigView 仅管理员可访问，普通用户显示权限提示
- BuildView/HistoryView 所有 API 请求携带 token

backend/routers/tasks.py

@@ -15,7 +15,7 @@ from ..models import Task
 from ..schemas import TaskCreate, TaskResponse
 from ..deps import get_current_user
 
-router = APIRouter(prefix="/api/tasks", tags=["tasks"])
+router = APIRouter(prefix="/api/tasks", tags=["tasks"], dependencies=[Depends(get_current_user)])
 
 
 @router.post("", response_model=TaskResponse)
@@ -106,7 +106,7 @@ async def get_task(task_id: str, db: Session = Depends(get_db)):
     return _enrich_tasks([task])[0]
 
 
-@router.delete("/{task_id}", dependencies=[Depends(get_current_user)])
+@router.delete("/{task_id}")
 async def cancel_task(task_id: str, db: Session = Depends(get_db)):
     """取消任务"""
     task = db.query(Task).filter(Task.id == task_id).first()
@@ -137,7 +137,7 @@ async def cancel_task(task_id: str, db: Session = Depends(get_db)):
     return {"message": "任务已取消"}
 
 
-@router.delete("/{task_id}/delete", dependencies=[Depends(get_current_user)])
+@router.delete("/{task_id}/delete")
 async def delete_task(task_id: str, db: Session = Depends(get_db)):
     """删除打包记录"""
     import shutil