feat: add system settings page for admin username and password

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/auth.py

@@ -1,4 +1,4 @@
-"""简单 Token 鉴权（对齐策略仓：密码换 HMAC token）。"""
+"""简单 Token 鉴权（用户名 + 密码 → HMAC token）。"""
 
 from __future__ import annotations
 
@@ -21,24 +21,35 @@ def auth_disabled() -> bool:
     return (s.auth_secret or "").strip().lower() in ("", "disabled", "off", "none")
 
 
-def _token_for_password(password: str, secret: str) -> str:
+def _token_for_credentials(username: str, password: str, secret: str) -> str:
+    payload = f"{username}:{password}"
     return hmac.new(
         secret.encode("utf-8"),
-        password.encode("utf-8"),
+        payload.encode("utf-8"),
         hashlib.sha256,
     ).hexdigest()
 
 
+def verify_credentials(username: str, password: str) -> bool:
+    s = get_settings()
+    u = (username or "").strip()
+    if not u:
+        return False
+    return secrets.compare_digest(u, s.admin_username) and secrets.compare_digest(
+        password, s.admin_password
+    )
+
+
 def expected_token() -> str:
     s = get_settings()
-    return _token_for_password(s.admin_password, s.auth_secret)
+    return _token_for_credentials(s.admin_username, s.admin_password, s.auth_secret)
 
 
-def issue_token(password: str) -> str | None:
+def issue_token(username: str, password: str) -> str | None:
     s = get_settings()
-    if not secrets.compare_digest(password, s.admin_password):
+    if not verify_credentials(username, password):
         return None
-    return _token_for_password(password, s.auth_secret)
+    return _token_for_credentials(username, password, s.auth_secret)
 
 
 def _extract_token(
@@ -53,7 +64,6 @@ def _extract_token(
         return authorization[7:].strip()
     if x_mi_token:
         return x_mi_token.strip()
-    # 查询参数兜底（方便内网脚本；生产建议只用 Header）
     q = request.query_params.get("token")
     if q:
         return q.strip()
@@ -69,10 +79,6 @@ def require_auth(
     x_mi_token: Annotated[str | None, Header(alias="X-MI-Token")] = None,
     creds: Annotated[HTTPAuthorizationCredentials | None, Depends(_bearer)] = None,
 ) -> None:
-    """
-    AUTH_SECRET=disabled 时跳过。
-    否则需要 Bearer / X-MI-Token / Cookie / ?token=。
-    """
     if auth_disabled():
         return
     token = _extract_token(request, authorization, x_mi_token, creds)