feat(auth): 登录页(用户名/密码换 API token)+ 前端全链路登录态

后端:
- POST /api/auth/login:admin 账密(Settings 默认 admin/admin123,
  ADMIN_USER/ADMIN_PASSWORD 可覆盖)换取共享 api_token,免 token 中间件
- 防爆破:同 IP 15min 窗口内 5 次失败锁 15min(429),成功登录清零
- 错误信息统一「用户名或密码错误」(防用户名枚举)
- 测试 7 个新增(TDD),全量 500 绿

前端:
- LoginView + 路由守卫(未登录跳 /login,回跳 redirect)
- axios 请求拦截器自动带 Bearer;401 清登录态回登录页
- 媒体直链统一 mediaUrl() 带 ?token=(img/audio 标签发不了 header),
  替换 4 处裸拼;downloadBlob 手动带头
- isLoggedIn 按 key 存在判定 — 后端鉴权关闭时空 token 不锁死登录页
- MainLayout 侧栏底部退出登录

compose:两份编排透传 ADMIN_USER/ADMIN_PASSWORD(默认 admin/admin123)

Co-Authored-By: Claude Code <noreply@anthropic.com>

yunkes/src/layouts/MainLayout.vue

@@ -2,6 +2,7 @@
 import { computed } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { useChannelStore } from '@/stores/channel'
+import { clearToken } from '@/api/client'
 import type { Channel } from '@/api/types'
 
 const route = useRoute()
@@ -32,6 +33,11 @@ function go(path: string, channel: Channel): void {
 function goPlain(path: string): void {
   router.push(path)
 }
+
+function logout(): void {
+  clearToken()
+  router.push({ name: 'login' })
+}
 </script>
 
 <template>
@@ -93,6 +99,11 @@ function goPlain(path: string): void {
             全局搜索
           </el-menu-item>
         </el-menu>
+        <div class="yk-sidenav__footer">
+          <el-button text class="yk-sidenav__logout" @click="logout">
+            退出登录
+          </el-button>
+        </div>
       </el-aside>
 
       <el-main class="yk-main">
@@ -104,6 +115,22 @@ function goPlain(path: string): void {
 
 <style scoped>
 /* ══ 墨玉侧栏:深墨底 + 玉绿血脉(2026-08-22) ══ */
+.yk-sidenav__footer {
+  margin-top: auto;
+  padding: 10px 16px;
+  border-top: 1px solid rgba(255, 255, 255, 0.08);
+}
+
+.yk-sidenav__logout {
+  width: 100%;
+  color: rgba(255, 255, 255, 0.65);
+}
+
+.yk-sidenav__logout:hover {
+  color: #fff;
+  background: rgba(255, 255, 255, 0.08);
+}
+
 .yk-sidenav {
   border-right: none;
   background: linear-gradient(180deg, #1a2130 0%, #141927 100%);