Initial commit: SenSu Alpha 0.2.0

- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)

services/web_panel/auth.py

@@ -0,0 +1,31 @@
+import logging
+logger = logging.getLogger(__name__)
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+import functools
+from aiohttp import web
+
+def panel_auth(handler):
+    """面板专用鉴权装饰器（替代子应用中间件）"""
+    @functools.wraps(handler)
+    async def wrapper(request, *args, **kwargs):
+        token = request.cookies.get("panel_token")
+        if not token and request.headers.get("Authorization", "").startswith("Bearer "):
+            token = request.headers["Authorization"].split(" ", 1)[1]
+            
+        auth_svc = request.app.get('auth_service')
+        is_valid = False
+        
+        if token and auth_svc:
+            try:
+                v = await auth_svc.validate_token(token)
+                is_valid = bool(v)
+            except: pass
+        elif not auth_svc:
+            is_valid = False  # 认证不可用时拒绝
+            
+        if not is_valid:
+            return web.json_response({"error": "未认证或会话过期"}, status=401)
+            
+        return await handler(request, *args, **kwargs)
+    return wrapper