Add roles/ACL so admin and users can issue activation codes; exe opens review login.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/templates/accounts.html

@@ -1,10 +1,12 @@
 {% extends "base.html" %}
 {% block title %}账户 · {{ app_name }}{% endblock %}
 {% block content %}
-<h2 style="margin:0 0 14px">账户标注</h2>
+<h2 style="margin:0 0 14px">账户{% if can_create %}（仅管理员可创建）{% else %}（只读自己的账户）{% endif %}</h2>
 <div class="grid cols-2">
+  {% if can_create %}
   <div class="card">
     <h3>新增账户</h3>
+    <p class="muted">账户禁止自助注册，创建后在「用户」中绑定给唯一操作员。</p>
     <form method="post" action="{{ url_for('accounts_create') }}">
       <div class="form-row"><label>名称</label><input name="name" required placeholder="如：模拟盘-A"></div>
       <div class="form-row"><label>券商</label><input name="broker" placeholder="MT5 券商名"></div>
@@ -21,8 +23,9 @@
       <button class="btn" type="submit">添加</button>
     </form>
   </div>
+  {% endif %}
   <div class="card">
-    <h3>已有账户</h3>
+    <h3>账户列表</h3>
     <table>
       <thead><tr><th>名称</th><th>类型</th><th>标注</th><th></th></tr></thead>
       <tbody>