feat(admin): art-design-pro integration with local session auth

P1b Task 9: apps/admin based on art-design-pro v3.0.2 (tag, commit
d224dd4; source recorded in apps/admin/SOURCE.md), trimmed to
layout/login/i18n/request/table-form core. Login wired to real
POST /v1/auth/password (single-token session), Bearer header on all
requests, 401 interceptor logout+redirect, request-driven sliding
renewal (refresh at ~80% TTL, single-flight), best-effort
POST /v1/auth/logout on user-menu logout. One protected stub page
(相册管理). Dev port 5176 strictPort + /v1 proxy to 8080. Admin keeps
its own eslint9 flat config; root eslint ignores apps/admin/**.
vitest unit tests for renewal pacing + Playwright e2e (guard redirect,
localized wrong-password error, login lands on stub, token persists
across reload, logout clears session).

Co-Authored-By: Claude Code <noreply@anthropic.com>

apps/admin/e2e/helpers.ts

@@ -0,0 +1,26 @@
+// e2e 辅助：从仓库根 .env 读种子管理员凭据（global-setup 已跑过幂等 seed）。
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const repoRoot = fileURLToPath(new URL('../../..', import.meta.url))
+
+export interface AdminCredentials {
+  account: string
+  password: string
+}
+
+export function adminCredentials(): AdminCredentials {
+  const envPath = join(repoRoot, '.env')
+  if (!existsSync(envPath)) {
+    throw new Error(`[admin e2e] 仓库根 .env 不存在（${envPath}）`)
+  }
+  const vars = new Map<string, string>()
+  for (const line of readFileSync(envPath, 'utf-8').split(/\r?\n/)) {
+    const match = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim())
+    if (match) vars.set(match[1], match[2])
+  }
+  const account = vars.get('ADMIN_ACCOUNT') ?? 'admin'
+  const password = vars.get('ADMIN_PASSWORD') ?? 'admin-secret-change-me'
+  return { account, password }
+}