feat(auth): 登录页(用户名/密码换 API token)+ 前端全链路登录态

后端:
- POST /api/auth/login:admin 账密(Settings 默认 admin/admin123,
  ADMIN_USER/ADMIN_PASSWORD 可覆盖)换取共享 api_token,免 token 中间件
- 防爆破:同 IP 15min 窗口内 5 次失败锁 15min(429),成功登录清零
- 错误信息统一「用户名或密码错误」(防用户名枚举)
- 测试 7 个新增(TDD),全量 500 绿

前端:
- LoginView + 路由守卫(未登录跳 /login,回跳 redirect)
- axios 请求拦截器自动带 Bearer;401 清登录态回登录页
- 媒体直链统一 mediaUrl() 带 ?token=(img/audio 标签发不了 header),
  替换 4 处裸拼;downloadBlob 手动带头
- isLoggedIn 按 key 存在判定 — 后端鉴权关闭时空 token 不锁死登录页
- MainLayout 侧栏底部退出登录

compose:两份编排透传 ADMIN_USER/ADMIN_PASSWORD(默认 admin/admin123)

Co-Authored-By: Claude Code <noreply@anthropic.com>

yunke-server/app/config.py

@@ -34,6 +34,13 @@ class Settings(BaseSettings):
     # <token>`` or ``?token=<token>``. See app/api/auth.py.
     api_token: str = ""
 
+    # Username/password for the SPA login page (``POST /api/auth/login``).
+    # On success the login hands out the ``api_token`` above so the SPA can
+    # act as a Bearer client; defaults keep local dev zero-config. Change both
+    # in prod via ADMIN_USER / ADMIN_PASSWORD.
+    admin_user: str = "admin"
+    admin_password: str = "admin123"
+
     # Comma-separated list of allowed CORS origins for the viewing API. Empty
     # (default) -> only the dev fallback (``http://localhost:5173``) is allowed;
     # set ``CORS_ORIGINS=https://app.example.com`` in prod to lock cross-origin