Add roles/ACL so admin and users can issue activation codes; exe opens review login.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/templates/machines.html

@@ -1,8 +1,9 @@
 {% extends "base.html" %}
 {% block title %}机器 · {{ app_name }}{% endblock %}
 {% block content %}
-<h2 style="margin:0 0 14px">机器标注</h2>
+<h2 style="margin:0 0 14px">机器{% if is_admin %}（管理员可预登记）{% else %}（与本账户相关）{% endif %}</h2>
 <div class="grid cols-2">
+  {% if is_admin %}
   <div class="card">
     <h3>预登记机器</h3>
     <p class="muted">也可不预登记：激活时自动创建机器并绑定指纹。</p>
@@ -12,6 +13,7 @@
       <button class="btn" type="submit">添加</button>
     </form>
   </div>
+  {% endif %}
   <div class="card">
     <h3>已有机器</h3>
     <table>
@@ -20,12 +22,18 @@
         {% for m in items %}
         <tr>
           <td>
+            {% if is_admin %}
             <form method="post" action="{{ url_for('machines_note', mid=m.id) }}">
               <input name="name" value="{{ m.name }}" style="margin-bottom:6px">
               <div class="muted">{{ m.device_fingerprint or '未绑定' }}</div>
               <textarea name="note" rows="2" style="margin-top:6px">{{ m.note or '' }}</textarea>
               <button class="btn secondary" style="margin-top:6px" type="submit">保存</button>
             </form>
+            {% else %}
+            <div>{{ m.name }}</div>
+            <div class="muted">{{ m.device_fingerprint or '未绑定' }}</div>
+            {% if m.note %}<div class="muted" style="margin-top:6px">{{ m.note }}</div>{% endif %}
+            {% endif %}
           </td>
           <td class="muted">{{ m.last_seen_at or '—' }}</td>
           <td>#{{ m.id }}</td>