feat: add API key and login authentication to WebUI

- protect API routes with API key or authenticated session
- add /login page and /api/v1/login, /api/v1/logout endpoints
- gate dashboard behind session cookie
- auto-bootstrap webui username/password/api_key if unset
- add logout action to dashboard and cookie-aware API client

internal/plugins/webui/plugin.go

@@ -1,6 +1,9 @@
 package webui
 
 import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
 	"log"
 	"net/http"
 
@@ -109,9 +112,45 @@ func New(name, addr string,
 	}
 }
 
+func randomSecret(n int) string {
+	buf := make([]byte, n)
+	if _, err := rand.Read(buf); err != nil {
+		return ""
+	}
+	return hex.EncodeToString(buf)
+}
+
+func (p *Plugin) ensureAuthBootstrap(s *sdk.PluginSDK) {
+	sett := s.Settings()
+	if sett == nil {
+		return
+	}
+	if v, _ := sett.Get("username"); v == nil || fmt.Sprint(v) == "" {
+		_ = sett.Set("username", "admin")
+	}
+	if v, _ := sett.Get("password"); v == nil || fmt.Sprint(v) == "" {
+		pw := randomSecret(12)
+		_ = sett.Set("password", pw)
+		log.Printf("[webui] bootstrap password generated for user admin: %s", pw)
+	}
+	if v, _ := sett.Get("api_key"); v == nil || fmt.Sprint(v) == "" {
+		key := randomSecret(16)
+		_ = sett.Set("api_key", key)
+		log.Printf("[webui] bootstrap api_key generated: %s", key)
+	}
+	if v, _ := sett.Get("session_ttl_hours"); v == nil || fmt.Sprint(v) == "" {
+		_ = sett.Set("session_ttl_hours", "24")
+	}
+}
+
 func (p *Plugin) Name() string { return p.name }
 
 func (p *Plugin) Start(s *sdk.PluginSDK) error {
+	s.Settings().RegisterDef(sdk.ConfigDef{Key: "api_key", Default: "", Type: "password", DisplayName: "API 密钥", Description: "访问 API 时需要的密钥", Category: "webui"})
+	s.Settings().RegisterDef(sdk.ConfigDef{Key: "username", Default: "admin", Type: "string", DisplayName: "登录用户名", Description: "Web 控制台登录用户名", Category: "webui"})
+	s.Settings().RegisterDef(sdk.ConfigDef{Key: "password", Default: "", Type: "password", DisplayName: "Web 控制台登录密码", Description: "Web 控制台登录密码", Category: "webui"})
+	s.Settings().RegisterDef(sdk.ConfigDef{Key: "session_ttl_hours", Default: "24", Type: "int", DisplayName: "会话时长(小时)", Description: "登录 cookie 有效时长", Category: "webui"})
+	p.ensureAuthBootstrap(s)
 	h := NewHandler(p.sup, p.mem, p.sk, p.lua, p.cfg, p.iom, p.tm, p.ks, p.tr, p.cr, p.pr, p.evBus, p.statusProvider)
 	p.handler = h
 	h.RegisterRoutes(p.mux)