feat: JWT过期自动重置 + 用户端登录页 + 系统设置前三个真实实现

agent-111 JWT过期重置+系统设置去占位:
- ws.ts 识别401/过期 markAuthExpired(清token+停重连+expired态),isTokenExpired;wsParse.ts拆出压行371;scheduleReconnect有token未过期才重连
- api.ts REST 401→auth_expired+清token+引导重登;login走skipAuthExpired密码错不误清
- types.ts WsStatus加expired;TopBar/Nav expired显示登录过期;System.tsx去alert占位改4张事实卡+合并Notice

agent-113 用户端登录页:
- components/Login.tsx Miuix登录卡(用户名/密码→login()→setAuthToken);App !getAuthToken()→<Login>;AdminApp LoginGate指向

agent-112 系统设置前三个(owner+审计):
- auth.APIKey.RevokeAll(吊销全部key);auth.JWTService.RotateSecret(≥32校验+并发安全+新密钥不回显)
- gateway admin_system.go: POST revoke-keys/rotate-jwt/backup(VACUUM INTO)/restore(防路径穿越+恢复前自动备份+原子替换+需重启)
- wire.go 传DatabasePath;全仓 build/vet/test绿+交叉编译;api-client v0.17系统设置契约

实机验证: 登录(role=owner)+revoke-keys 200+渠道列表含kook; 全仓绿+前端build绿; .env密码仅登录验证不打印

internal/services/gateway/server.go

@@ -247,6 +247,12 @@ type Deps struct {
 	// data; the composition root injects NewSQLiteAuditStore over a.db for real
 	// persistence. Optional.
 	AuditStore AuditStore
+	// DatabasePath is the resolved path of the SQLite database file the
+	// composition root actually opened (the value derived by resolveSQLitePath,
+	// which may differ from cfg.DB.SQLitePath when the data dir default applies).
+	// It backs the admin backup/restore endpoints. Optional; when empty those
+	// endpoints answer honestly with a clear not-configured error.
+	DatabasePath string
 	// Streaming marks the injected Loop as streaming-capable (its OnStream is
 	// wired to publish ws.stream_chunk). When set the hub skips its own single
 	// final stream_chunk emission, since deltas already stream through OnStream.
@@ -286,6 +292,7 @@ type Server struct {
 	voice       VoiceService
 	streaming   bool
 	frontend    fs.FS
+	dbPath      string
 	// llm is the hot-swappable provider stack (models.json). When nil the
 	// admin /llm endpoints fall back to the env config. It is optional so tests
 	// that do not wire it keep working.
@@ -329,6 +336,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		llm:         deps.LLM,
 		channels:    deps.Channels,
 		webhooks:    deps.Webhooks,
+		dbPath:      deps.DatabasePath,
 		log:         sourcedLog(deps.Log),
 	}
 	s.hub = newHub(s)
@@ -415,6 +423,10 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/v1/admin/memories/search", ownerAuth(http.HandlerFunc(s.adminMemorySearch)))
 	mux.Handle("POST /api/v1/admin/rag", ownerAuth(http.HandlerFunc(s.adminIndexRag)))
 	mux.Handle("GET /api/v1/admin/sessions/{id}/export", adminAuth(http.HandlerFunc(s.adminExportSession)))
+	mux.Handle("POST /api/v1/admin/system/revoke-keys", ownerAuth(http.HandlerFunc(s.adminRevokeAllKeys)))
+	mux.Handle("POST /api/v1/admin/system/rotate-jwt", ownerAuth(http.HandlerFunc(s.adminRotateJWT)))
+	mux.Handle("POST /api/v1/admin/system/backup", ownerAuth(http.HandlerFunc(s.adminBackup)))
+	mux.Handle("POST /api/v1/admin/system/restore", ownerAuth(http.HandlerFunc(s.adminRestore)))
 
 	// External webhook callbacks (e.g. the webhook channel) are mounted without
 	// gateway auth; each handler enforces its own signature/authorization.