serve 多用户认证体系

单密码→多用户：auth.json 格式迁移，login 支持用户名密码，
新增用户管理 API 和前端页面，会话关联 username，
auth middleware 将当前用户注入 request.state。

Co-Authored-By: Claude <noreply@anthropic.com>

serve/frontend/src/pages/Auth.tsx

@@ -20,6 +20,7 @@ import { cn } from '@/lib/cn'
 
 export function Auth() {
   const navigate = useNavigate()
+  const [username, setUsername] = useState('admin')
   const [password, setPassword] = useState('')
   const [confirmPassword, setConfirmPassword] = useState('')  // 仅设密码时用
   const [showPwd, setShowPwd] = useState(false)
@@ -43,7 +44,7 @@ export function Auth() {
       if (isSetup) {
         return api.authSetup(password)
       }
-      return api.authLogin(password)
+      return api.authLogin(username, password)
     },
     onSuccess: () => {
       // 成功: 跳回原页面(或首页)
@@ -112,6 +113,17 @@ export function Auth() {
           </div>
 
           <form onSubmit={handleSubmit} className="space-y-3">
+            {/* 用户名(仅登录模式) */}
+            {!isSetup && (
+              <input
+                type="text"
+                value={username}
+                onChange={e => setUsername(e.target.value)}
+                placeholder="用户名"
+                autoFocus
+                className="h-10 w-full rounded-btn border border-border bg-base px-3 text-sm text-foreground outline-none transition-colors focus:border-accent/50"
+              />
+            )}
             {/* 密码输入 */}
             <div className="relative">
               <input
@@ -119,7 +131,7 @@ export function Auth() {
                 value={password}
                 onChange={e => setPassword(e.target.value)}
                 placeholder="访问密码"
-                autoFocus
+                autoFocus={isSetup}
                 className="h-10 w-full rounded-btn border border-border bg-base px-3 pr-9 text-sm text-foreground outline-none transition-colors focus:border-accent/50"
               />
               <button