feat: cluster reliability (leader failover, crash rejoin, key exchange) + auth/users + canvas/forwards enhancements + comprehensive README + API docs

- Cluster: forwardToNext offline detection (leader+non-leader), WatchLeader 1s heartbeat fallback, 409 for standalone nodes, Node.NodeKey key exchange via token ring, ClusterPeers persistence + auto-rejoin, Forward delegates to forwardToNext (bugfix)
- Auth: Basic Auth (flag-creds fast path) + bcrypt users (admin/viewer) + Bearer API keys (read/write/admin scope)
- Frontend: UsersView (accounts+API keys), ClusterView (ring/nodeKey/tasks/topology/log), StatusView (group management, per-proxy status), CanvasView (edge toggle/group), PortEdge (disabled/group labels)
- API: handlers split (canvas/forwards/users/logs), canvas export/import, forwards group start/stop/assign/delete, cluster endpoints
- Docs: comprehensive README rewrite (all flags/APIs/auth/cluster), docs/cluster-api.md (cluster management API reference)
- Deploy: run-cluster.sh now 4-node ring + 1 isolated standalone, test-forward.sh updated for 4 nodes
- Removed plan.md (design notes consolidated into README + API docs)

web/src/types.ts

@@ -74,6 +74,13 @@ export interface Link {
   remotePort: number;
   offsetX?: number;
   offsetY?: number;
+  // group: management label for one-click group start/stop on the forwards
+  // page (unrelated to frps load-balancing lbGroup on Local).
+  group?: string;
+  // disabled: per-forward stop flag. A disabled forward is omitted from the
+  // frpc config (local) / left out of the ring topology (cluster), so stop is
+  // per-card and survives canvas re-saves.
+  disabled?: boolean;
 }
 
 export interface CanvasData {
@@ -130,6 +137,28 @@ export interface StatusResp {
   binaryPath: string;
   profiles: StatusProfile[];
   localStatus: LocalStatus[];
+  // forwards: the forward-centric list rendered as cards on the status page.
+  forwards: ForwardStatus[];
+  // selfId: this node's ring ID (== SelfAddr), to tell whether a cluster
+  // forward's owner is this node (worker runs here) or a peer.
+  selfId: string;
+}
+
+// ForwardStatus is one forward (link) in the forward-centric status view.
+// kind distinguishes 本地转发 (localOnly) from 远程转发 (cluster-distributed).
+export interface ForwardStatus {
+  local: string;
+  remote: string;
+  remotePort: number;
+  localOnly: boolean;
+  kind: "local" | "remote";
+  ownerId?: string; // remote = topology owner; local = selfId
+  active: boolean; // remote = in topology; local = local worker running
+  disabled: boolean; // per-forward stop flag (true = stopped)
+  group?: string;
+  localIp?: string;
+  localPort?: number;
+  localProto?: string;
 }
 
 export interface LocalTargetStatus {
@@ -182,7 +211,7 @@ export interface RingNode {
   addr: string;
   isLeader?: boolean;
   alive: boolean;
-  load: { memPct: number; netPct: number };
+  load: { memPct: number; netPct: number; forwards?: number };
   version?: string;
   cache?: string[];
   lastSeen?: number;
@@ -211,6 +240,7 @@ export interface RingLogEntry {
   node: string;
   kind: string;
   at?: number;
+  data?: Record<string, any> | null;
 }
 
 export interface RingSnapshot {
@@ -223,4 +253,88 @@ export interface RingSnapshot {
   pending: RingTaskInfo[];
   topology: RingTopoEntry[];
   log: RingLogEntry[];
+  // nodeKey: this node's cluster admission key. Newcomers must present it to
+  // join via this node (handleClusterJoin verifies). Shown on the cluster page
+  // for the operator to copy; omitted for non-cluster (standalone) nodes.
+  nodeKey?: string;
+}
+
+// ---- Auth / accounts / API keys (M7) ----
+
+export type AccessLevel = 'read' | 'write' | 'admin';
+
+// MeResp is the authenticated principal (GET /me). The frontend uses level to
+// gate the UI: viewer (= auditors) sees read + export controls only.
+export interface MeResp {
+  type: 'user' | 'service' | 'key';
+  name: string;
+  level: AccessLevel;
+  userId?: number;
+}
+
+export interface User {
+  id: number;
+  username: string;
+  role: 'admin' | 'viewer';
+  enabled: boolean;
+  system?: boolean; // flag-synced built-in account (UI read-only)
+  createdAt: number;
+  lastLoginAt: number;
+}
+
+export interface ApiKey {
+  id: number;
+  userId: number;
+  prefix: string;
+  label: string;
+  scope: AccessLevel;
+  createdAt: number;
+  lastUsedAt: number;
+  expiresAt?: number;
+}
+
+// ApiKeyCreated is the one-time response from POST /apikeys: the plaintext key
+// is shown exactly once and never retrievable again.
+export interface ApiKeyCreated {
+  id: number;
+  userId: number;
+  label: string;
+  scope: AccessLevel;
+  prefix: string;
+  createdAt: number;
+  key: string;
+}
+
+export interface CanvasExportEnvelope {
+  _type: 'webui4frpc-canvas';
+  version: number;
+  exportedAt: number;
+  exporter: string;
+  canvas: CanvasData;
+}
+
+// Worker-log bundle (GET /cluster/logs/export): one entry per alive ring node.
+export interface WorkerLogEntry {
+  name: string;
+  remote: string;
+  state: string;
+  lines: string;
+}
+export interface NodeLogsResp {
+  node: string;
+  workers: WorkerLogEntry[];
+}
+export interface ClusterWorkerLogNode {
+  id: string;
+  addr: string;
+  ok: boolean;
+  error?: string;
+  logs?: NodeLogsResp;
+}
+export interface WorkerLogBundle {
+  _type: 'webui4frpc-worker-logs';
+  version: number;
+  exportedAt: number;
+  requester: string;
+  nodes: ClusterWorkerLogNode[];
 }