feat(admin): 系统设置接入已实现的后端4端点(吊销key/轮换JWT/备份/恢复)，未实现项诚实标注

frontend/web/src/lib/api.ts

@@ -38,6 +38,10 @@ import type {
   RagIndexRequest,
   Role,
   SessionMeta,
+  SystemBackupResp,
+  SystemRestoreResp,
+  SystemRevokeKeysResp,
+  SystemRotateJwtResp,
   WeixinLoginQRResponse,
   WeixinLoginStatusResponse,
   SessionRecord,
@@ -713,3 +717,36 @@ function limitQuery(limit?: number): string {
 export function adminBackthink(limit?: number): Promise<BackthinkItem[]> {
   return request<BackthinkItem[]>(`/admin/backthink${limitQuery(limit)}`);
 }
+
+/* ----------------------------------------------------------------------------
+ * System management admin writes (owner-only, audited). Reference:
+ * internal/services/gateway/admin_system.go + Docs/api-client.md §系统设置契约.
+ * All four are implemented (not 501) — they return real data.
+ * -------------------------------------------------------------------------- */
+
+/** POST /api/v1/admin/system/revoke-keys — revokes every registered API key. */
+export function adminSystemRevokeKeys(): Promise<SystemRevokeKeysResp> {
+  return request<SystemRevokeKeysResp>("/admin/system/revoke-keys", { method: "POST" });
+}
+/** POST /api/v1/admin/system/rotate-jwt — swaps the JWT signing secret (≥32 chars).
+ *  The secret is provided by the owner and never echoed back; all existing tokens
+ *  become invalid, so the client must re-login afterward. */
+export function adminSystemRotateJWT(newSecret: string): Promise<SystemRotateJwtResp> {
+  return request<SystemRotateJwtResp>("/admin/system/rotate-jwt", {
+    method: "POST",
+    body: JSON.stringify({ newSecret }),
+  });
+}
+/** POST /api/v1/admin/system/backup — snapshots the SQLite DB (VACUUM INTO, incl. WAL). */
+export function adminSystemBackup(): Promise<SystemBackupResp> {
+  return request<SystemBackupResp>("/admin/system/backup", { method: "POST" });
+}
+/** POST /api/v1/admin/system/restore — restores a data-dir backup; path must live
+ *  inside the data directory (path-traversal guard). The backend pre-backups the
+ *  current DB and reports that the swap needs a restart. */
+export function adminSystemRestore(path: string): Promise<SystemRestoreResp> {
+  return request<SystemRestoreResp>("/admin/system/restore", {
+    method: "POST",
+    body: JSON.stringify({ path }),
+  });
+}