feat(server): 新增修改密码接口 POST /api/auth/password（验原密码、作废会话）

console/renderer/app.js

@@ -20,7 +20,11 @@ const el = {
   btnRestart: document.getElementById('btn-restart'),
   btnRelayout: document.getElementById('btn-relayout'),
   btnOpenAdmin: document.getElementById('btn-open-admin'),
-  btnClearLog: document.getElementById('btn-clear-log')
+  btnClearLog: document.getElementById('btn-clear-log'),
+  titlebar: document.getElementById('titlebar'),
+  winMin: document.getElementById('win-min'),
+  winMax: document.getElementById('win-max'),
+  winClose: document.getElementById('win-close')
 }
 
 const DOT_CLASS = {
@@ -31,10 +35,7 @@ const DOT_CLASS = {
   stopped: ''
 }
 
-let lastStatus = null
-
 function renderStatus(status) {
-  lastStatus = status
   el.version.textContent = status.appVersion ? `v${status.appVersion}` : ''
 
   el.stateDot.className = `dot ${status.healthy ? 'ok' : DOT_CLASS[status.state] || ''}`
@@ -104,6 +105,28 @@ async function refresh() {
   renderStatus(await window.consoleApi.getStatus())
 }
 
+function renderMaximized(maximized) {
+  el.winMax.classList.toggle('is-maximized', maximized)
+  const label = maximized ? '还原' : '最大化'
+  el.winMax.title = label
+  el.winMax.setAttribute('aria-label', label)
+}
+
+function bindWindowControls() {
+  el.winMin.addEventListener('click', () => window.consoleApi.minimize())
+  el.winMax.addEventListener('click', () => window.consoleApi.maximize())
+  el.winClose.addEventListener('click', () => window.consoleApi.close())
+
+  // 双击标题栏切换最大化；点在按钮上的双击不算，否则连点会误触
+  el.titlebar.addEventListener('dblclick', (event) => {
+    if (event.target instanceof Element && event.target.closest('.win-btn')) return
+    window.consoleApi.maximize()
+  })
+
+  window.consoleApi.onMaximizeChange(renderMaximized)
+  window.consoleApi.isMaximized().then(renderMaximized)
+}
+
 function bindActions() {
   el.btnStart.addEventListener('click', async () => renderStatus(await window.consoleApi.startService()))
   el.btnStop.addEventListener('click', async () => renderStatus(await window.consoleApi.stopService()))
@@ -113,14 +136,12 @@ function bindActions() {
     await window.consoleApi.clearLog()
     setLog([])
   })
-  el.btnOpenAdmin.addEventListener('click', () => {
-    const url = (lastStatus && lastStatus.adminUrl) || 'http://127.0.0.1:8080/admin'
-    window.consoleApi.openExternal(url)
-  })
+  el.btnOpenAdmin.addEventListener('click', () => window.consoleApi.openServerAdmin())
 }
 
 async function boot() {
   bindActions()
+  bindWindowControls()
   window.consoleApi.onStatus(renderStatus)
   window.consoleApi.onLog(appendLog)
   setLog(await window.consoleApi.getLog())

console/renderer/index.html

@@ -10,7 +10,8 @@
     <link rel="stylesheet" href="styles.css" />
   </head>
   <body>
-    <header class="topbar">
+    <!-- 窗口是无边框的，标题栏和最小化/最大化/关闭三键都在这条上自绘 -->
+    <header id="titlebar" class="topbar">
       <div class="brand">
         <span class="brand-mark"></span>
         <div>
@@ -20,6 +21,27 @@
       </div>
       <div class="topbar-right">
         <span id="app-version" class="muted"></span>
+        <div class="win-controls">
+          <button id="win-min" class="win-btn" type="button" title="最小化" aria-label="最小化">
+            <svg viewBox="0 0 24 24" width="16" height="16" aria-hidden="true">
+              <path d="M5 12h14" />
+            </svg>
+          </button>
+          <button id="win-max" class="win-btn" type="button" title="最大化" aria-label="最大化">
+            <svg class="icon-max" viewBox="0 0 24 24" width="16" height="16" aria-hidden="true">
+              <rect x="5" y="5" width="14" height="14" rx="2" />
+            </svg>
+            <svg class="icon-restore" viewBox="0 0 24 24" width="16" height="16" aria-hidden="true">
+              <rect x="4" y="8" width="12" height="12" rx="2" />
+              <path d="M8 8V6a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2h-2" />
+            </svg>
+          </button>
+          <button id="win-close" class="win-btn win-btn-close" type="button" title="关闭" aria-label="关闭">
+            <svg viewBox="0 0 24 24" width="16" height="16" aria-hidden="true">
+              <path d="M6 6l12 12M18 6 6 18" />
+            </svg>
+          </button>
+        </div>
       </div>
     </header>
 

console/renderer/preload.js

@@ -18,6 +18,12 @@ contextBridge.exposeInMainWorld('consoleApi', {
   clearLog: () => ipcRenderer.invoke('log:clear'),
   relayoutDisplays: () => ipcRenderer.invoke('display:relayout'),
   openExternal: (url) => ipcRenderer.invoke('app:open-external', url),
+  openServerAdmin: () => ipcRenderer.invoke('app:open-server-admin'),
+  minimize: () => ipcRenderer.invoke('window:minimize'),
+  maximize: () => ipcRenderer.invoke('window:maximize'),
+  close: () => ipcRenderer.invoke('window:close'),
+  isMaximized: () => ipcRenderer.invoke('window:is-maximized'),
+  onMaximizeChange: (callback) => subscribe('window:maximize-changed', callback),
   onLog: (callback) => subscribe('log:line', callback),
   onStatus: (callback) => subscribe('service:status', callback)
 })

console/renderer/shell-preload.js

@@ -0,0 +1,18 @@
+'use strict'
+
+const { contextBridge, ipcRenderer } = require('electron')
+
+// 服务端管理面板是 http://127.0.0.1 下的 Web 页面，只放行窗口控制这一组能力，
+// 不把 ipcRenderer 交给页面，避免面板页面拿到主进程的任意通道
+contextBridge.exposeInMainWorld('desktopShell', {
+  platform: process.platform,
+  minimize: () => ipcRenderer.invoke('window:minimize'),
+  maximize: () => ipcRenderer.invoke('window:maximize'),
+  close: () => ipcRenderer.invoke('window:close'),
+  isMaximized: () => ipcRenderer.invoke('window:is-maximized'),
+  onMaximizeChange: (callback) => {
+    const handler = (_event, maximized) => callback(maximized)
+    ipcRenderer.on('window:maximize-changed', handler)
+    return () => ipcRenderer.removeListener('window:maximize-changed', handler)
+  }
+})

console/renderer/styles.css

@@ -33,9 +33,15 @@ body {
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 14px 20px;
+  gap: 16px;
+  height: 50px;
+  flex: 0 0 auto;
+  padding: 0 8px 0 16px;
   border-bottom: 1px solid var(--border);
   background: var(--panel);
+  /* 整条标题栏拖拽，按钮区单独开洞，否则按钮点不动 */
+  -webkit-app-region: drag;
+  user-select: none;
 }
 
 .brand {
@@ -45,25 +51,99 @@ body {
 }
 
 .brand-mark {
-  width: 10px;
-  height: 34px;
-  border-radius: 5px;
+  width: 8px;
+  height: 22px;
+  border-radius: 4px;
   background: linear-gradient(180deg, var(--accent), #1b6bb8);
 }
 
 h1 {
   margin: 0;
-  font-size: 16px;
+  font-size: 15px;
   font-weight: 600;
+  line-height: 1.25;
   letter-spacing: 0.02em;
 }
 
 .brand-sub {
   margin: 0;
-  font-size: 12px;
+  font-size: 11px;
+  line-height: 1.3;
   color: var(--muted);
 }
 
+.topbar-right {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.win-controls {
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  -webkit-app-region: no-drag;
+}
+
+.win-btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 32px;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: 8px;
+  background: transparent;
+  color: var(--muted);
+  cursor: pointer;
+  transition:
+    background 0.15s ease,
+    color 0.15s ease,
+    border-color 0.15s ease;
+}
+
+.win-btn svg {
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.7;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+
+.win-btn:hover {
+  background: rgba(255, 255, 255, 0.08);
+  color: var(--text);
+}
+
+.win-btn:active {
+  background: rgba(255, 255, 255, 0.14);
+}
+
+.win-btn:focus-visible {
+  outline: 2px solid var(--accent);
+  outline-offset: -2px;
+}
+
+/* 关闭键是唯一的破坏性操作，hover 变红做区分 */
+.win-btn-close:hover {
+  border-color: var(--err);
+  background: var(--err);
+  color: #fff;
+}
+
+.win-btn .icon-restore {
+  display: none;
+}
+
+.win-btn.is-maximized .icon-max {
+  display: none;
+}
+
+.win-btn.is-maximized .icon-restore {
+  display: block;
+}
+
 main {
   flex: 1;
   min-height: 0;