feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

agent-111 JWT过期重置+系统设置去占位:
- ws.ts 识别401/过期 markAuthExpired(清token+停重连+expired态),isTokenExpired;wsParse.ts拆出压行371;scheduleReconnect有token未过期才重连
- api.ts REST 401→auth_expired+清token+引导重登;login走skipAuthExpired密码错不误清
- types.ts WsStatus加expired;TopBar/Nav expired显示登录过期;System.tsx去alert占位改4张事实卡+合并Notice

agent-113 用户端登录页:
- components/Login.tsx Miuix登录卡(用户名/密码→login()→setAuthToken);App !getAuthToken()→<Login>;AdminApp LoginGate指向

agent-112 系统设置前三个(owner+审计):
- auth.APIKey.RevokeAll(吊销全部key);auth.JWTService.RotateSecret(≥32校验+并发安全+新密钥不回显)
- gateway admin_system.go: POST revoke-keys/rotate-jwt/backup(VACUUM INTO)/restore(防路径穿越+恢复前自动备份+原子替换+需重启)
- wire.go 传DatabasePath;全仓 build/vet/test绿+交叉编译;api-client v0.17系统设置契约

实机验证: 登录(role=owner)+revoke-keys 200+渠道列表含kook; 全仓绿+前端build绿; .env密码仅登录验证不打印

frontend/web/src/App.tsx

@@ -3,6 +3,7 @@ import { TopBar } from "./components/TopBar";
 import { Sidebar, MobileNav } from "./components/Nav";
 import { ModeRouter } from "./modes/ModeRouter";
 import { AdminApp } from "./admin/AdminApp";
+import { Login } from "./components/Login";
 import { parseAdminHash } from "./admin/router";
 import { connectWs, disconnectWs } from "./lib/ws";
 import { initTheme } from "./lib/theme";
@@ -121,6 +122,14 @@ export default function App(): React.ReactNode {
     return <AdminApp section={route.section} />;
   }
 
+  // No credential: never render the chat shell (it would silently show an
+  // "未登录" shell with no way in). Show the user-side login card instead; its
+  // onSuccess reloads the page so connectWs + session/persona effects re-run
+  // with the fresh token. Admin shell keeps its own LoginGate (#/admin).
+  if (!getAuthToken()) {
+    return <Login onSuccess={() => window.location.reload()} />;
+  }
+
   return (
     <div className="flex h-full flex-col">
       <TopBar onMenu={() => setMenuOpen(true)} />