加上登录和角色权限，并用 Vue 控制台区分用户与管理员。

Co-authored-by: Cursor <cursoragent@cursor.com>

app/main.py

@@ -12,9 +12,12 @@ from fastapi.staticfiles import StaticFiles
 
 import app.models  # noqa: F401  注册全部表
 from app.api import router
-from app.database import Base, engine
+from app.database import Base, engine, session_scope
 from app.errors import AppError
 from app.scheduler import start_scheduler, stop_scheduler
+from app.schema_upgrade import upgrade_schema
+from app.security import ensure_jwt_secret
+from app.services.auth import ensure_admin
 
 logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s %(message)s")
 
@@ -22,6 +25,10 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name
 @asynccontextmanager
 async def lifespan(_: FastAPI):
     Base.metadata.create_all(bind=engine)
+    upgrade_schema()
+    with session_scope() as session:
+        ensure_jwt_secret(session)
+        ensure_admin(session)
     start_scheduler()
     try:
         yield
@@ -33,19 +40,36 @@ WEB_DIR = Path(__file__).resolve().parent.parent / "web"
 
 app = FastAPI(title="HyperNode-AI", version="1.0.0", lifespan=lifespan)
 app.include_router(router)
-app.mount("/static", StaticFiles(directory=WEB_DIR), name="static")
-
-
-@app.get("/")
-def console() -> FileResponse:
-    return FileResponse(WEB_DIR / "index.html")
-
-
-@app.exception_handler(AppError)
-async def handle_app_error(_: Request, exc: AppError) -> JSONResponse:
-    return JSONResponse(status_code=exc.status_code, content={"detail": exc.message})
+_assets = WEB_DIR / "assets"
+if _assets.is_dir():
+    app.mount("/assets", StaticFiles(directory=_assets), name="assets")
 
 
 @app.get("/health")
 def health() -> dict[str, str]:
     return {"status": "ok"}
+
+
+@app.get("/")
+def console() -> FileResponse:
+    return _spa("")
+
+
+@app.get("/{full_path:path}")
+def console_routes(full_path: str) -> FileResponse:
+    return _spa(full_path)
+
+
+def _spa(full_path: str) -> FileResponse:
+    root = WEB_DIR.resolve()
+    index = root / "index.html"
+    if full_path:
+        candidate = (root / full_path).resolve()
+        if candidate.is_file() and (candidate == root or root in candidate.parents):
+            return FileResponse(candidate)
+    return FileResponse(index)
+
+
+@app.exception_handler(AppError)
+async def handle_app_error(_: Request, exc: AppError) -> JSONResponse:
+    return JSONResponse(status_code=exc.status_code, content={"detail": exc.message})