serve 多用户认证体系

单密码→多用户：auth.json 格式迁移，login 支持用户名密码，
新增用户管理 API 和前端页面，会话关联 username，
auth middleware 将当前用户注入 request.state。

Co-Authored-By: Claude <noreply@anthropic.com>

serve/frontend/src/lib/api.ts

@@ -589,16 +589,16 @@ export const api = {
 
   // ===== Auth (访问认证) =====
   authStatus: () =>
-    request<{ configured: boolean; authenticated: boolean }>('/api/auth/status'),
+    request<{ configured: boolean; authenticated: boolean; username?: string | null; role?: string | null }>('/api/auth/status'),
   authSetup: (password: string) =>
     request<{ ok: boolean }>('/api/auth/setup', {
       method: 'POST',
       body: JSON.stringify({ password }),
     }),
-  authLogin: (password: string) =>
-    request<{ ok: boolean }>('/api/auth/login', {
+  authLogin: (username: string, password: string) =>
+    request<{ ok: boolean; username?: string }>('/api/auth/login', {
       method: 'POST',
-      body: JSON.stringify({ password }),
+      body: JSON.stringify({ username, password }),
     }),
   authLogout: () =>
     request<{ ok: boolean }>('/api/auth/logout', { method: 'POST' }),
@@ -607,6 +607,22 @@ export const api = {
       method: 'POST',
       body: JSON.stringify({ old_password: oldPassword, new_password: newPassword }),
     }),
+  authUsers: () =>
+    request<{ users: { username: string; role: string; created_at?: number }[] }>('/api/auth/users'),
+  authCreateUser: (username: string, password: string, role: string) =>
+    request<{ ok: boolean }>('/api/auth/users', {
+      method: 'POST',
+      body: JSON.stringify({ username, password, role }),
+    }),
+  authDeleteUser: (username: string) =>
+    request<{ ok: boolean }>(`/api/auth/users/${encodeURIComponent(username)}`, {
+      method: 'DELETE',
+    }),
+  authResetPassword: (username: string, newPassword: string) =>
+    request<{ ok: boolean }>(`/api/auth/users/${encodeURIComponent(username)}/reset-password`, {
+      method: 'POST',
+      body: JSON.stringify({ new_password: newPassword }),
+    }),
 
   settings: () => request<SettingsState>('/api/settings'),
   saveTickflowKey: (api_key: string) =>