Remove API URL UI; add username/password change in settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/credentials.py

@@ -0,0 +1,69 @@
+"""运行时登录凭据：内存生效 + 持久化到 .env。"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from threading import Lock
+
+from .config import get_settings
+
+_lock = Lock()
+_username: str | None = None
+_password: str | None = None
+
+
+def _env_paths() -> list[Path]:
+    here = Path(__file__).resolve()
+    # backend/app/credentials.py -> repo root = parents[2]
+    root = here.parents[2]
+    return [root / ".env", Path.cwd() / ".env", Path.cwd().parent / ".env"]
+
+
+def _ensure_loaded() -> None:
+    global _username, _password
+    if _username is not None and _password is not None:
+        return
+    s = get_settings()
+    _username = s.auth_username
+    _password = s.auth_password
+
+
+def get_credentials() -> tuple[str, str]:
+    with _lock:
+        _ensure_loaded()
+        assert _username is not None and _password is not None
+        return _username, _password
+
+
+def upsert_env_file(key: str, value: str) -> Path | None:
+    """写入第一个已存在的 .env；都不存在则写仓库根 .env。"""
+    paths = _env_paths()
+    target = next((p for p in paths if p.is_file()), paths[0])
+    target.parent.mkdir(parents=True, exist_ok=True)
+    text = target.read_text(encoding="utf-8") if target.is_file() else ""
+    line = f"{key}={value}"
+    pattern = re.compile(rf"(?m)^{re.escape(key)}=.*$")
+    if pattern.search(text):
+        text = pattern.sub(line, text)
+    else:
+        if text and not text.endswith("\n"):
+            text += "\n"
+        text += line + "\n"
+    target.write_text(text, encoding="utf-8")
+    return target
+
+
+def update_credentials(*, new_username: str, new_password: str) -> None:
+    global _username, _password
+    user = new_username.strip()
+    pwd = new_password
+    if not user or not pwd:
+        raise ValueError("用户名和密码不能为空")
+    with _lock:
+        upsert_env_file("AUTH_USERNAME", user)
+        upsert_env_file("AUTH_PASSWORD", pwd)
+        _username = user
+        _password = pwd
+        # 刷新 Settings 缓存，避免进程内读到旧值
+        get_settings.cache_clear()