加上登录和角色权限，并用 Vue 控制台区分用户与管理员。

Co-authored-by: Cursor <cursoragent@cursor.com>

app/models.py

@@ -98,6 +98,11 @@ class PushStatus(str, enum.Enum):
     FAILED = "failed"
 
 
+class UserRole(str, enum.Enum):
+    USER = "user"
+    ADMIN = "admin"
+
+
 class User(Base):
     """用户。一个钱包地址对应一名用户，可绑定多台算力节点。"""
 
@@ -105,6 +110,9 @@ class User(Base):
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     wallet_address: Mapped[str] = mapped_column(String(128), unique=True, index=True)
+    username: Mapped[str | None] = mapped_column(String(32), unique=True, index=True)
+    password_hash: Mapped[str | None] = mapped_column(String(255))
+    role: Mapped[UserRole] = mapped_column(_enum(UserRole), default=UserRole.USER, index=True)
     created_at: Mapped[datetime] = mapped_column(UtcDateTime, default=utcnow)
 
     nodes: Mapped[list[ComputeNode]] = relationship(back_populates="user")
@@ -241,6 +249,15 @@ class WithdrawalLog(Base):
     user: Mapped[User] = relationship(back_populates="withdrawals")
 
 
+class AppSetting(Base):
+    """进程重启后仍要保留的运行时密钥，例如未写入环境变量的 JWT 密钥。"""
+
+    __tablename__ = "app_settings"
+
+    key: Mapped[str] = mapped_column(String(64), primary_key=True)
+    value: Mapped[str] = mapped_column(Text)
+
+
 class SchedulerLock(Base):
     """定时任务锁。锁到期后其他实例才能接手，进程崩溃不会永久占住任务。"""