feat: web login system, auto-load history, config extraction

- Add Flask session-based authentication (username/password login)
- Auto-load chat history from backend on page load
- Extract SECRET_KEY and user credentials to web_config.json
- Create web_config.example.json as template
- Add web_config.json to .gitignore (sensitive info)
- Update docs: architecture, API reference, quick start guides

docs/en/api.md

@@ -505,4 +505,25 @@ Common errors:
 |--------------|-------------|
 | `API Key not configured` | API Key not set |
 | `timeout` | Request timeout |
-| `Tool call rejected: ...` | Tool call rate exceeded limit |
+| `Tool call rejected: ...` | Tool call rate exceeded limit |
+
+## Web API Endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | /api/check-auth | Check if current session is authenticated |
+| POST | /api/login | Login (JSON body: username, password) |
+| POST | /api/logout | Logout |
+| GET | /api/history | Get chat history |
+| POST | /api/message | Send message to AI |
+| POST | /api/tools/execute | Execute tool call |
+| GET | /api/status | Get system status |
+| GET | /api/settings | Get settings |
+| PUT | /api/settings | Update settings |
+| DELETE | /api/history | Clear history |
+| POST | /api/shutdown | Shutdown server |
+| GET | /api/activity | Get database operation records |
+| GET | /api/graph | Get knowledge graph data |
+| GET | /api/graph/highlight | Get highlighted nodes |
+
+All API endpoints (except /api/login and /api/check-auth) require authentication. Login uses Flask sessions with 7-day validity.

docs/en/architecture.md

@@ -32,7 +32,11 @@ TrulyMEM-TrueHumanMEM/
 │   ├── services/       # Service layer (config only)
 │   ├── handlers/      # Event handlers
 │   └── styles/         # Style files
-└── tests/              # Tests (54 tests)
+├── web_api.py             # Web API service (login + RESTful API)
+├── templates/login.html   # Login page template
+├── static/                # Web frontend static files (star map visualization)
+├── web_config.json        # Web service config file (sensitive, not committed)
+└── web_config.example.json # Web config template
 ```
 
 ## Architecture Diagram

docs/en/quick_start.md

@@ -40,6 +40,26 @@ TrulyMEM.exe
 
 Config will be automatically saved to `~/.trulymem/config.json` and loaded on next startup.
 
+### Web Visualization (Optional)
+
+TrulyMEM provides a Web star-map visualization interface for browsing the knowledge graph in real-time:
+
+```bash
+# Start Web service
+python web_api.py --port 4096
+```
+
+Then open `http://localhost:4096` in your browser.
+
+**Login Setup:**
+1. Copy `web_config.example.json` to `web_config.json`
+2. Set login password (using SHA256) and secret key
+3. Web service will automatically read the config
+
+Default port is 4096, change with `--port` flag.
+
+---
+
 ## Keyboard Shortcuts
 
 | Key | Function |

docs/zh/api.md

@@ -511,4 +511,25 @@ asyncio.run(main())
 |---------|------|
 | `API Key 未配置` | 未设置 API Key |
 | `timeout` | 请求超时 |
-| `工具调用被拒绝: ...` | 工具调用频率超限 |
+| `工具调用被拒绝: ...` | 工具调用频率超限 |
+
+## Web API 端点
+
+| 方法 | 路径 | 说明 |
+|------|------|------|
+| GET | /api/check-auth | 检查当前会话是否已登录 |
+| POST | /api/login | 登录（JSON body: username, password） |
+| POST | /api/logout | 登出 |
+| GET | /api/history | 获取聊天历史 |
+| POST | /api/message | 发送消息给 AI |
+| POST | /api/tools/execute | 执行工具调用 |
+| GET | /api/status | 获取系统状态 |
+| GET | /api/settings | 获取设置 |
+| PUT | /api/settings | 更新设置 |
+| DELETE | /api/history | 清空历史 |
+| POST | /api/shutdown | 关闭服务器 |
+| GET | /api/activity | 获取数据库操作记录 |
+| GET | /api/graph | 获取知识图谱数据 |
+| GET | /api/graph/highlight | 获取高亮节点 |
+
+所有 API 端点（除 /api/login 和 /api/check-auth 外）需要登录认证。登录使用 Flask session，有效期 7 天。

docs/zh/architecture.md

@@ -32,7 +32,11 @@ TrulyMEM-TrueHumanMEM/
 │   ├── services/       # 服务层（仅配置管理）
 │   ├── handlers/      # 事件处理
 │   └── styles/         # 样式文件
-└── tests/              # 测试 (54 tests)
+├── web_api.py             # Web API 服务（登录 + RESTful API）
+├── templates/login.html   # 登录页面模板
+├── static/                # Web 前端静态文件（星图可视化）
+├── web_config.json        # Web 服务配置文件（敏感信息，不提交）
+└── web_config.example.json # Web 配置模板
 ```
 
 ## 架构图

docs/zh/quick_start.md

@@ -40,6 +40,26 @@ TrulyMEM.exe
 
 配置会自动保存到 `~/.trulymem/config.json`，下次启动自动加载。
 
+### Web 可视化界面（可选）
+
+TrulyMEM 提供 Web 星图可视化界面，支持实时浏览知识图谱：
+
+```bash
+# 启动 Web 服务
+python web_api.py --port 4096
+```
+
+然后打开浏览器访问 `http://localhost:4096`。
+
+**登录配置：**
+1. 复制 `web_config.example.json` 为 `web_config.json`
+2. 设置登录密码（使用 SHA256）和 secret key
+3. Web 服务会自动读取该配置
+
+默认端口 4096，可通过 `--port` 参数修改。
+
+---
+
 ## 快捷键
 
 | 按键 | 功能 |