Initial commit: SenSu Alpha 0.2.0

- 13-service async plugin framework
- Textual TUI with CLI fallback
- Plugin hot-reload + permission system
- Web management panel (aiohttp)
- Bridge-based inter-module communication
- 10 regression tests

Fixes applied:
- PBKDF2-SHA256 auth (was plain SHA256)
- Auth bypass removed (was allow-all on fail)
- Bare excepts replaced with logged errors
- CatFramework/DreamSu -> SenSu naming unified
- ServiceManager: health checks + startup_order
- Env var credentials (SENSU_ADMIN_PASSWORD etc)

services/web_panel/utils/auth.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import functools
+from aiohttp import web
+
+def panel_auth(handler):
+    """面板专用鉴权装饰器：基于面板自有的 Session Store 验证"""
+    @functools.wraps(handler)
+    async def wrapper(request, *args, **kwargs):
+        # 1. 获取 Token
+        token = request.cookies.get("panel_token")
+        if not token and request.headers.get("Authorization", "").startswith("Bearer "):
+            token = request.headers["Authorization"].split(" ", 1)[1]
+            
+        is_valid = False
+        
+        # 2. 从面板 Session Store 验证
+        session_store = request.app.get('panel_session_store', {})
+        if token and token in session_store:
+            is_valid = True
+            # 验证通过，将用户信息注入 request 供后续使用
+            request['user'] = session_store[token]
+        
+        # 3. 拦截逻辑 (不再依赖外部 AuthService，确保安全隔离)
+        if not is_valid:
+            # 返回 401 并附带提示，前端可据此判断状态
+            return web.json_response({
+                "error": "未认证或会话已过期", 
+                "status": 401
+            }, status=401)
+            
+        return await handler(request, *args, **kwargs)
+    return wrapper