feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

agent-111 JWT过期重置+系统设置去占位:
- ws.ts 识别401/过期 markAuthExpired(清token+停重连+expired态),isTokenExpired;wsParse.ts拆出压行371;scheduleReconnect有token未过期才重连
- api.ts REST 401→auth_expired+清token+引导重登;login走skipAuthExpired密码错不误清
- types.ts WsStatus加expired;TopBar/Nav expired显示登录过期;System.tsx去alert占位改4张事实卡+合并Notice

agent-113 用户端登录页:
- components/Login.tsx Miuix登录卡(用户名/密码→login()→setAuthToken);App !getAuthToken()→<Login>;AdminApp LoginGate指向

agent-112 系统设置前三个(owner+审计):
- auth.APIKey.RevokeAll(吊销全部key);auth.JWTService.RotateSecret(≥32校验+并发安全+新密钥不回显)
- gateway admin_system.go: POST revoke-keys/rotate-jwt/backup(VACUUM INTO)/restore(防路径穿越+恢复前自动备份+原子替换+需重启)
- wire.go 传DatabasePath;全仓 build/vet/test绿+交叉编译;api-client v0.17系统设置契约

实机验证: 登录(role=owner)+revoke-keys 200+渠道列表含kook; 全仓绿+前端build绿; .env密码仅登录验证不打印

cmd/cyrene/wire.go

@@ -76,6 +76,7 @@ type app struct {
 	cfg           *config.Config
 	log           *slog.Logger
 	db            *sql.DB
+	dbPath        string
 	bus           bus.Bus
 	modelAdapter  model.Adapter
 	llm           *model.RuntimeLLM
@@ -138,11 +139,12 @@ func newApp(ctx context.Context, cfg *config.Config, log *slog.Logger) (*app, er
 
 	eventBus := bus.New()
 	a := &app{
-		cfg:  cfg,
-		log:  log,
-		db:   sqlDB,
-		bus:  eventBus,
-		caps: registry.New(),
+		cfg:    cfg,
+		log:    log,
+		db:     sqlDB,
+		dbPath: databasePath,
+		bus:    eventBus,
+		caps:   registry.New(),
 	}
 
 	// Release already-opened resources if any later wiring step fails, without
@@ -598,28 +600,29 @@ func (a *app) wireFrontend() error {
 	// and the gateway share the same persistent store. History was a no-op dependency
 	// before the IM path, so nothing downstream depends on its creation order change.
 	gw, err := gateway.New(a.cfg, gateway.Deps{
-		Log:         logger.WithSource(a.log, "gateway"),
-		Auth:        jwt,
-		Bus:         a.bus,
-		Registry:    a.caps,
-		Loop:        a.loop,
-		Session:     a.sessions,
-		Personas:    a.personas,
-		Memories:    a.memStore,
-		History:     a.history,
-		IoT:         a.iot,
-		Scheduler:   a.scheduler,
-		Tasks:       a.tasks,
-		Automations: a.automation,
-		Users:       apiKeys,
-		Backthink:   a.backthink,
-		RAG:         ragStore,
-		LLM:         a.llm,
-		Channels:    a.channels,
-		AuditStore:  auditStore,
-		Streaming:   true,
-		Frontend:    resolveFrontendFS(a.log),
-		Webhooks:    a.channelBridge.WebhookHandlers(),
+		Log:          logger.WithSource(a.log, "gateway"),
+		Auth:         jwt,
+		Bus:          a.bus,
+		Registry:     a.caps,
+		Loop:         a.loop,
+		Session:      a.sessions,
+		Personas:     a.personas,
+		Memories:     a.memStore,
+		History:      a.history,
+		IoT:          a.iot,
+		Scheduler:    a.scheduler,
+		Tasks:        a.tasks,
+		Automations:  a.automation,
+		Users:        apiKeys,
+		Backthink:    a.backthink,
+		RAG:          ragStore,
+		LLM:          a.llm,
+		Channels:     a.channels,
+		AuditStore:   auditStore,
+		Streaming:    true,
+		Frontend:     resolveFrontendFS(a.log),
+		Webhooks:     a.channelBridge.WebhookHandlers(),
+		DatabasePath: a.dbPath,
 	})
 	if err != nil {
 		return fmt.Errorf("gateway: %w", err)