feat: 多用户管理系统，管理员可分配用户

- 新增 users 数据库表，存储用户名、密码哈希、角色
- 启动时自动从 .env 创建初始管理员账号
- 登录改为数据库校验，不再硬编码比对
- 新增 /api/users 管理接口（仅管理员）
- ConfigView 新增用户管理页（创建、改密码、切换角色、删除）

backend/routers/auth.py

@@ -2,10 +2,13 @@
 import jwt
 from datetime import datetime, timedelta, timezone
 from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
 
 from ..schemas import LoginRequest, LoginResponse
-from ..config import ADMIN_USERNAME, ADMIN_PASSWORD, JWT_SECRET, JWT_ALGORITHM, JWT_EXPIRE_HOURS
+from ..config import JWT_SECRET, JWT_ALGORITHM, JWT_EXPIRE_HOURS
 from ..deps import get_current_user
+from ..database import get_db
+from ..models import User
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
@@ -20,13 +23,21 @@ def _create_token(username: str, is_admin: bool) -> str:
     return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
 
 
+def _verify_password(password: str, password_hash: str) -> bool:
+    """校验密码"""
+    import hashlib
+    return hashlib.sha256(password.encode()).hexdigest() == password_hash
+
+
 @router.post("/login", response_model=LoginResponse)
-async def login(request: LoginRequest):
-    """管理员登录"""
-    if request.username == ADMIN_USERNAME and request.password == ADMIN_PASSWORD:
-        token = _create_token(request.username, is_admin=True)
-        return LoginResponse(token=token, username=request.username, is_admin=True)
-    raise HTTPException(status_code=401, detail="用户名或密码错误")
+async def login(request: LoginRequest, db: Session = Depends(get_db)):
+    """用户登录"""
+    user = db.query(User).filter(User.username == request.username).first()
+    if not user or not _verify_password(request.password, user.password_hash):
+        raise HTTPException(status_code=401, detail="用户名或密码错误")
+
+    token = _create_token(user.username, user.is_admin)
+    return LoginResponse(token=token, username=user.username, is_admin=user.is_admin)
 
 
 @router.get("/me")