fix: 审查修复波次（P0x4 + P1x30+）

- domain/rules: 计分与排名解耦、破纪录按组别、tieBreak 生效、调整分不丢、移除 aggregate 假能力
- realtime: 新建 internal/dto，快照三项契约对齐，/ws 只认会话身份
- httpapi: 流水幂等、standings 整表载荷、广播接线、强制改密、XFF 防伪造、records 写入、审计、赛事包内容、发布前备份、result.points、实例列表
- web: FormData 上传、YAML 解析、快照归一化、大屏解析层、bootstrap 降级、访客判定、主题切换
- console: 优雅关闭握手、中文化、免验证改管理员账号、选屏与日志轮转修复
- docs: 用户文档三份 + README
- 主代理: 破纪录加分接线（levels 未加载导致恒 0）

web/src/shared/api.ts

@@ -1,4 +1,7 @@
-import { isRecord, readString } from './internal'
+import { isRawBody, isRecord, readString } from './internal'
+import { normalizeRulePack } from './rules'
+import { isGuestRole } from './session'
+import { parseYaml } from './yaml'
 import type {
   AdjustmentInput,
   ApiErrorCode,
@@ -204,6 +207,7 @@ interface Http {
   request<T>(path: string, options?: RequestOptions): Promise<T>
   requestVoid(path: string, options?: RequestOptions): Promise<void>
   requestJson(path: string, options?: RequestOptions): Promise<unknown>
+  requestText(path: string, options?: RequestOptions): Promise<string>
   url(path: string, query?: object): string
   blob(path: string, options?: RequestOptions): Promise<Blob>
 }
@@ -276,7 +280,21 @@ function createExportApi(http: Http): ExportApi {
 
 function createRulesApi(http: Http): RulesApi {
   return {
-    get: () => http.request<RulePack>('/rules/export'),
+    // 导出接口返回的是裸 YAML 文本（不是 {ok,data}），必须按文本取回再解析。
+    get: async () => {
+      const text = await http.requestText('/rules/export')
+      let parsed: unknown
+      try {
+        parsed = parseYaml(text)
+      } catch (error) {
+        throw new ApiError('PARSE_FAILED', '规则包 YAML 解析失败', 0, error)
+      }
+      const pack = normalizeRulePack(parsed)
+      if (pack === null) {
+        throw new ApiError('PARSE_FAILED', '规则包格式不符（需要 scoreboard-rules v1）', 0, parsed)
+      }
+      return pack
+    },
     preview: (pack) =>
       http.request<RulePackImportPreview>('/rules/import', {
         method: 'POST',
@@ -343,20 +361,27 @@ export class ApiClient {
       request: (path, requestOptions) => this.request(path, requestOptions),
       requestVoid: (path, requestOptions) => this.requestVoid(path, requestOptions),
       requestJson: (path, requestOptions) => this.requestJson(path, requestOptions),
+      requestText: (path, requestOptions) => this.requestText(path, requestOptions),
       url: (path, query) => this.buildUrl(path, query),
       blob: (path, requestOptions) => this.fetchBlob(path, requestOptions),
     }
 
     this.auth = {
-      login: (username, password) =>
-        http.request<CurrentUser>('/auth/login', { method: 'POST', body: { username, password } }),
+      login: async (username, password) =>
+        markGuest(
+          await http.request<CurrentUser>('/auth/login', {
+            method: 'POST',
+            body: { username, password },
+          }),
+        ),
       changePassword: (currentPassword, newPassword) =>
         http.request<{ relogin: boolean }>('/auth/password', {
           method: 'POST',
           body: { currentPassword, newPassword },
         }),
       logout: () => http.requestVoid('/auth/logout', { method: 'POST' }),
-      me: () => http.request<CurrentUser>('/auth/me'),
+      // 未登录时服务端回 200 + guest DTO，这里补出 guest 标记供 isGuestUser 判定。
+      me: async () => markGuest(await http.request<CurrentUser>('/auth/me')),
     }
 
     this.settings = {
@@ -452,6 +477,21 @@ export class ApiClient {
     return body
   }
 
+  /** 规则包导出等接口返回裸文本（非 JSON），错误体仍按 {ok,error} 解析。 */
+  private async requestText(path: string, options: RequestOptions = {}): Promise<string> {
+    const response = await this.send(path, options)
+    if (!response.ok) {
+      const body = await readBody(response)
+      if (response.status === 401) {
+        const error = this.toApiError(body, response.status)
+        this.onUnauthorized?.(error)
+        throw error
+      }
+      throw this.toApiError(body, response.status)
+    }
+    return response.text()
+  }
+
   private async fetchBlob(path: string, options: RequestOptions = {}): Promise<Blob> {
     const response = await this.send(path, options)
     if (!response.ok) {
@@ -469,10 +509,16 @@ export class ApiClient {
   private async send(path: string, options: RequestOptions): Promise<Response> {
     const method: HttpMethod = options.method ?? 'GET'
     const payload = this.prepareBody(method, options.body)
+    // 断言：二进制 / 表单载荷只能原样透传，一旦被归一化展开就会静默丢内容（报名表导入踩过）。
+    if (isRawBody(options.body) && payload !== options.body) {
+      throw new ApiError('INTERNAL', '请求体归一化破坏了 FormData/Blob 载荷', 0, options.body)
+    }
     const headers: Record<string, string> = { Accept: 'application/json' }
 
     if (payload instanceof FormData) {
       // 交给浏览器带 multipart boundary，手动设置 Content-Type 会丢 boundary。
+    } else if (isRawBody(payload)) {
+      // Blob / URLSearchParams 自带类型语义，Content-Type 交给 fetch 决定。
     } else if (payload !== undefined) {
       headers['Content-Type'] = 'application/json; charset=utf-8'
     }
@@ -499,7 +545,7 @@ export class ApiClient {
         body:
           payload === undefined
             ? undefined
-            : payload instanceof FormData
+            : isRawBody(payload)
               ? payload
               : JSON.stringify(payload),
         signal: controller.signal,
@@ -517,6 +563,8 @@ export class ApiClient {
   /** 写操作注入 requestId：网络抖动重发时服务端能返回首次结果而不是重复执行。 */
   private prepareBody(method: HttpMethod, body: unknown): unknown {
     if (method === 'GET' || body === undefined) return undefined
+    // FormData/Blob/URLSearchParams 不能展开，否则文件/二进制内容会被丢掉。
+    if (isRawBody(body)) return body
     if (isRecord(body) && !('requestId' in body)) {
       return { ...body, requestId: this.newRequestId() }
     }
@@ -568,6 +616,14 @@ function isScalar(value: unknown): value is string | number | boolean {
   return typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean'
 }
 
+/**
+ * 服务端未登录时 /auth/me 也回 200 + guest DTO，
+ * 这里把 role 结论固化成 guest 字段，调用方用 isGuestUser(user) 判定即可。
+ */
+function markGuest(user: CurrentUser): CurrentUser {
+  return { ...user, guest: isGuestRole(user.role) }
+}
+
 async function readBody(response: Response): Promise<unknown> {
   if (response.status === 204) return null
   const text = await response.text()