新增访问记录(仅超管): 登录成功/失败/退出/账号操作审计含IP, 顶栏入口在账号管理旁, 弹框展示+可清空

scripts/smoke.js

@@ -106,6 +106,13 @@ const sleep = (ms) => new Promise(r => setTimeout(r, ms));
   await p.screenshot({ path: '/tmp/smoke-shots/04-users.png' });
   await p.evaluate(() => document.getElementById('userModal').classList.add('hidden'));
 
+  console.log('== 7b. 访问记录(超管) ==');
+  ok('顶栏访问记录入口可见', await $('#accessLogBtn').isVisible());
+  await p.evaluate(() => openAccessModal()); await sleep(600);
+  const alogText = await p.evaluate(() => document.getElementById('alogBody').innerText);
+  ok('访问记录含本次登录', alogText.includes('登录成功') && alogText.includes(SU));
+  await p.evaluate(() => document.getElementById('accessModal').classList.add('hidden'));
+
   console.log('== 8. 退出 → HR登录 ==');
   await p.evaluate(() => logout()); await sleep(800);
   await p.goto(BASE + '/', { waitUntil: 'networkidle' });
@@ -113,6 +120,9 @@ const sleep = (ms) => new Promise(r => setTimeout(r, ms));
   await $('#loginBtn').click(); await sleep(900);
   ok('HR进入主界面', await $('#main').isVisible());
   ok('HR看不到账号管理入口', await p.evaluate(() => getComputedStyle(document.getElementById('userMgrBtn')).display === 'none'));
+  ok('HR看不到访问记录入口', await p.evaluate(() => getComputedStyle(document.getElementById('accessLogBtn')).display === 'none'));
+  const alogForbidden = await p.evaluate(async () => (await fetch('/api/access-log')).status);
+  ok('HR访问记录API被403拦截', alogForbidden === 403);
   const forbidden = await p.evaluate(async () => {
     const r = await fetch('/api/users'); return r.status;
   });