feat: 全站登录保护，管理后台仅管理员可访问

- tasks 路由级认证保护，所有 API 需登录
- 未登录时显示登录页面，不暴露导航和功能
- ConfigView 仅管理员可访问，普通用户显示权限提示
- BuildView/HistoryView 所有 API 请求携带 token

frontend/src/views/BuildView.vue

@@ -138,9 +138,19 @@
 </template>
 
 <script setup>
-import { ref, onMounted, nextTick, watch, onUnmounted } from 'vue'
+import { ref, onMounted, nextTick, watch, onUnmounted, inject } from 'vue'
 import { useRoute } from 'vue-router'
 
+const getToken = inject('getToken')
+
+const authFetch = (url, options = {}) => {
+  const token = getToken()
+  if (token) {
+    options.headers = { ...options.headers, 'Authorization': `Bearer ${token}` }
+  }
+  return fetch(url, options)
+}
+
 const apps = ref({})
 const schemes = ref({})
 const branches = ref(['main'])
@@ -164,7 +174,7 @@ let skipNextConnect = false
 
 const fetchTaskDetail = async (taskId) => {
   try {
-    const res = await fetch(`/api/tasks/${taskId}`)
+    const res = await authFetch(`/api/tasks/${taskId}`)
     if (res.ok) {
       completedTask.value = await res.json()
     }
@@ -175,7 +185,7 @@ const fetchTaskDetail = async (taskId) => {
 
 const fetchBuildLog = async (taskId) => {
   try {
-    const res = await fetch(`/api/tasks/${taskId}/log`)
+    const res = await authFetch(`/api/tasks/${taskId}/log`)
     if (res.ok) {
       const data = await res.json()
       if (data.log) {
@@ -257,10 +267,10 @@ onUnmounted(() => {
 
 onMounted(async () => {
   const [appsRes, schemesRes, branchesRes, tasksRes] = await Promise.all([
-    fetch('/api/apps'),
-    fetch('/api/schemes'),
-    fetch('/api/branches'),
-    fetch('/api/tasks'),
+    authFetch('/api/apps'),
+    authFetch('/api/schemes'),
+    authFetch('/api/branches'),
+    authFetch('/api/tasks'),
   ])
   apps.value = await appsRes.json()
   schemes.value = await schemesRes.json()
@@ -302,7 +312,7 @@ const submitTask = async () => {
   }
   submitting.value = true
   try {
-    const res = await fetch('/api/tasks', {
+    const res = await authFetch('/api/tasks', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(form.value),
@@ -329,7 +339,7 @@ const selectTask = (taskId) => {
 const cancelTask = async () => {
   if (!currentTaskId.value) return
   if (!confirm('确定取消当前任务？')) return
-  const res = await fetch(`/api/tasks/${currentTaskId.value}`, { method: 'DELETE' })
+  const res = await authFetch(`/api/tasks/${currentTaskId.value}`, { method: 'DELETE' })
   if (!res.ok) {
     const err = await res.json().catch(() => ({}))
     alert(err.detail || '取消失败')
@@ -342,7 +352,7 @@ const cancelTask = async () => {
 }
 
 const refreshTasks = async () => {
-  const res = await fetch('/api/tasks?limit=50')
+  const res = await authFetch('/api/tasks?limit=50')
   const all = await res.json()
   // 显示未完成的任务 + 当前选中的任务
   tasks.value = all.filter(t =>