feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

agent-111 JWT过期重置+系统设置去占位:
- ws.ts 识别401/过期 markAuthExpired(清token+停重连+expired态),isTokenExpired;wsParse.ts拆出压行371;scheduleReconnect有token未过期才重连
- api.ts REST 401→auth_expired+清token+引导重登;login走skipAuthExpired密码错不误清
- types.ts WsStatus加expired;TopBar/Nav expired显示登录过期;System.tsx去alert占位改4张事实卡+合并Notice

agent-113 用户端登录页:
- components/Login.tsx Miuix登录卡(用户名/密码→login()→setAuthToken);App !getAuthToken()→<Login>;AdminApp LoginGate指向

agent-112 系统设置前三个(owner+审计):
- auth.APIKey.RevokeAll(吊销全部key);auth.JWTService.RotateSecret(≥32校验+并发安全+新密钥不回显)
- gateway admin_system.go: POST revoke-keys/rotate-jwt/backup(VACUUM INTO)/restore(防路径穿越+恢复前自动备份+原子替换+需重启)
- wire.go 传DatabasePath;全仓 build/vet/test绿+交叉编译;api-client v0.17系统设置契约

实机验证: 登录(role=owner)+revoke-keys 200+渠道列表含kook; 全仓绿+前端build绿; .env密码仅登录验证不打印

internal/auth/jwt_test.go

@@ -183,6 +183,49 @@ func TestJWTVerify_InvalidRoleClaim(t *testing.T) {
 	}
 }
 
+func TestJWTService_RotateSecret(t *testing.T) {
+	t.Parallel()
+	svc := New(testConfig(strings.Repeat("a", 40)))
+	token, err := svc.Sign("u", RoleOwner, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign error: %v", err)
+	}
+	if _, err := svc.Verify(token); err != nil {
+		t.Fatalf("Verify before rotation error: %v", err)
+	}
+	if err := svc.RotateSecret(strings.Repeat("b", 40)); err != nil {
+		t.Fatalf("RotateSecret error: %v", err)
+	}
+	// The previously issued token no longer verifies under the new secret.
+	if _, err := svc.Verify(token); !errors.Is(err, ErrInvalidSignature) {
+		t.Fatalf("Verify after rotation err = %v, want ErrInvalidSignature", err)
+	}
+	// A token signed under the new secret verifies fine.
+	newToken, err := svc.Sign("u", RoleOwner, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign after rotation error: %v", err)
+	}
+	if _, err := svc.Verify(newToken); err != nil {
+		t.Fatalf("Verify under new secret error: %v", err)
+	}
+}
+
+func TestJWTService_RotateSecretShort(t *testing.T) {
+	t.Parallel()
+	svc := New(testConfig(strings.Repeat("a", 40)))
+	if err := svc.RotateSecret("short"); !errors.Is(err, ErrInvalidSecret) {
+		t.Fatalf("RotateSecret(short) err = %v, want ErrInvalidSecret", err)
+	}
+	// A rejected short secret leaves the previous secret intact.
+	token, err := svc.Sign("u", RoleOwner, time.Hour)
+	if err != nil {
+		t.Fatalf("Sign error: %v", err)
+	}
+	if _, err := svc.Verify(token); err != nil {
+		t.Fatalf("Verify after rejected rotation error: %v", err)
+	}
+}
+
 func TestJWTVerify_Malformed(t *testing.T) {
 	t.Parallel()
 	svc := New(testConfig(""))