fix: 认证系统、登录兼容性、运行时配置、钉钉通知及代码清理

- 实现 JWT 认证中间件，保护配置管理和任务删除接口
- 修复 ConfigView 登录按钮（Vue 3 inject 替代 $root）
- 页面刷新时通过 /api/auth/me 校验 token 有效性
- max_concurrent_builds 修改后运行时即时生效
- 实现钉钉 webhook 通知（构建成功/失败自动推送）
- 删除未使用的 useWebSocket composable
- log_streamer 使用 LOG_QUEUE_MAX_SIZE 配置常量

backend/routers/auth.py

@@ -1,19 +1,35 @@
 """认证 API"""
-from fastapi import APIRouter
+import jwt
+from datetime import datetime, timedelta, timezone
+from fastapi import APIRouter, Depends, HTTPException
+
 from ..schemas import LoginRequest, LoginResponse
-from ..config import ADMIN_USERNAME, ADMIN_PASSWORD
+from ..config import ADMIN_USERNAME, ADMIN_PASSWORD, JWT_SECRET, JWT_ALGORITHM, JWT_EXPIRE_HOURS
+from ..deps import get_current_user
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
 
+def _create_token(username: str, is_admin: bool) -> str:
+    """生成 JWT token"""
+    payload = {
+        "sub": username,
+        "is_admin": is_admin,
+        "exp": datetime.now(timezone.utc) + timedelta(hours=JWT_EXPIRE_HOURS),
+    }
+    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
+
+
 @router.post("/login", response_model=LoginResponse)
 async def login(request: LoginRequest):
     """管理员登录"""
     if request.username == ADMIN_USERNAME and request.password == ADMIN_PASSWORD:
-        return LoginResponse(
-            token="admin-token",
-            username=request.username,
-            is_admin=True
-        )
-    from fastapi import HTTPException
+        token = _create_token(request.username, is_admin=True)
+        return LoginResponse(token=token, username=request.username, is_admin=True)
     raise HTTPException(status_code=401, detail="用户名或密码错误")
+
+
+@router.get("/me")
+async def get_me(user: dict = Depends(get_current_user)):
+    """校验 token 有效性，返回当前用户信息"""
+    return {"username": user["username"], "is_admin": user["is_admin"]}

backend/routers/config.py

@@ -10,8 +10,9 @@ from ..database import get_db
 from ..models import BuildConfig
 from ..schemas import BuildConfigUpdate
 from ..config import CONFIG_JSON_PATH, DEFAULT_MAX_CONCURRENT_BUILDS, DEFAULT_BUILD_DIR_RETENTION_HOURS
+from ..deps import get_current_user
 
-router = APIRouter(prefix="/api/config", tags=["config"])
+router = APIRouter(prefix="/api/config", tags=["config"], dependencies=[Depends(get_current_user)])
 
 _config_lock = asyncio.Lock()
 
@@ -314,6 +315,12 @@ async def update_build_settings(settings: BuildConfigUpdate, db: Session = Depen
             db.add(BuildConfig(key="build_base_dir", value=settings.build_base_dir))
 
     db.commit()
+
+    # 运行时更新并发数
+    if settings.max_concurrent_builds is not None:
+        from ..services.build_queue import build_queue
+        build_queue.update_max_concurrent(settings.max_concurrent_builds)
+
     return {"message": "打包设置已更新"}
 
 

backend/routers/tasks.py

@@ -13,6 +13,7 @@ from sqlalchemy.orm import Session
 from ..database import get_db
 from ..models import Task
 from ..schemas import TaskCreate, TaskResponse
+from ..deps import get_current_user
 
 router = APIRouter(prefix="/api/tasks", tags=["tasks"])
 
@@ -105,7 +106,7 @@ async def get_task(task_id: str, db: Session = Depends(get_db)):
     return _enrich_tasks([task])[0]
 
 
-@router.delete("/{task_id}")
+@router.delete("/{task_id}", dependencies=[Depends(get_current_user)])
 async def cancel_task(task_id: str, db: Session = Depends(get_db)):
     """取消任务"""
     task = db.query(Task).filter(Task.id == task_id).first()
@@ -136,7 +137,7 @@ async def cancel_task(task_id: str, db: Session = Depends(get_db)):
     return {"message": "任务已取消"}
 
 
-@router.delete("/{task_id}/delete")
+@router.delete("/{task_id}/delete", dependencies=[Depends(get_current_user)])
 async def delete_task(task_id: str, db: Session = Depends(get_db)):
     """删除打包记录"""
     import shutil