feat: 用户与权限管理

新增 PermissionCode 权限类型与用户/权限 API，路由注册用户设置/创建/权限页与无权访问页并接入权限守卫，AppSidebar 按权限过滤菜单并新增用户设置入口，auth store 与 mock 适配器同步支持用户管理与新登录认证，回归脚本与 npm 脚本注册。

frontend/src/mock/adapter.ts

@@ -5,7 +5,6 @@
  */
 import type { AxiosAdapter, AxiosInstance, AxiosRequestConfig } from 'axios'
 import {
-  mockLoginOk,
   mockHealth,
   mockSystemInfo,
   mockModels,
@@ -33,6 +32,14 @@ import {
   normalizeDatasetVersionState,
 } from './datasetVersions'
 import type { StoredDatasetVersion, StoredDatasetVersionState } from './datasetVersions'
+import {
+  authenticateMockUser,
+  createMockUser,
+  deleteMockUser,
+  listMockUsers,
+  updateMockUserAccess,
+  UserMutationError,
+} from './users'
 
 /** 模拟网络延迟 */
 function delay(ms = 200): Promise<void> {
@@ -128,10 +135,12 @@ async function handleMock(config: AxiosRequestConfig) {
 
   // ==================== 认证 ====================
   if (url === '/login' && method === 'post') {
-    if (body.username === 'admin' && body.password === 'admin') {
-      return ok(mockLoginOk.data)
+    try {
+      return ok(authenticateMockUser(String(body.username || ''), String(body.password || '')))
+    } catch (error) {
+      if (error instanceof UserMutationError) return fail(error.message, error.status)
+      return fail('登录失败', 500)
     }
-    return fail('账号或密码错误', 401)
   }
   if (url === '/web-log' && method === 'post') {
     return ok({ received: true })
@@ -141,6 +150,37 @@ async function handleMock(config: AxiosRequestConfig) {
   if (url === '/health' && method === 'get') return ok(mockHealth)
   if (url === '/system-info' && method === 'get') return ok(mockSystemInfo)
 
+  // ==================== 用户设置 ====================
+  if (url === '/users' && method === 'get') return ok(listMockUsers())
+  if (url === '/users' && method === 'post') {
+    try {
+      return ok(createMockUser(body))
+    } catch (error) {
+      if (error instanceof UserMutationError) return fail(error.message, error.status)
+      return fail('创建用户失败', 500)
+    }
+  }
+  let userMatch = url.match(/^\/users\/([^/]+)$/)
+  if (userMatch && method === 'put') {
+    try {
+      return ok(updateMockUserAccess(decodeURIComponent(userMatch[1]), body))
+    } catch (error) {
+      if (error instanceof UserMutationError) return fail(error.message, error.status)
+      return fail('更新用户失败', 500)
+    }
+  }
+  if (userMatch && method === 'delete') {
+    try {
+      return ok(deleteMockUser(
+        decodeURIComponent(userMatch[1]),
+        String(params.current_username || ''),
+      ))
+    } catch (error) {
+      if (error instanceof UserMutationError) return fail(error.message, error.status)
+      return fail('删除用户失败', 500)
+    }
+  }
+
   // ==================== 模型管理 ====================
   if (url === '/model-manage' && method === 'get') return ok(mockModels)
   if (url === '/model-manage/local-models' && method === 'get') return ok(mockLocalModels)