feat: 接入真实平台登录态

- login/session: 对接后端登录、鉴权恢复和首次改密
- api/store: 恢复 BPMN XML 真实接口并携带 Bearer token
- layout/settings: 展示真实角色、审计 JSON 和通知平台配置文档

src/services/devopsApi.ts

@@ -4,7 +4,9 @@
 import type {
   AgentCard,
   AgentInvocation,
+  AuthenticatedUser,
   AuditLogEntry,
+  ChangePasswordPayload,
   CreateAgentInvocationPayload,
   CreateDeployRunPayload,
   DashboardSummary,
@@ -16,6 +18,8 @@ import type {
   IntegrationVariableHelp,
   IntegrationStatus,
   JenkinsSyncSummary,
+  LoginPayload,
+  LoginResult,
   PipelineStep,
   ProjectConfig,
   ProjectRefs,
@@ -216,6 +220,29 @@ export const devopsApi = {
     return lastDataSource
   },
 
+  async login(payload: LoginPayload): Promise<LoginResult> {
+    const { data } = await http.post<LoginResult>('/auth/login', payload)
+    lastDataSource = 'backend'
+    return data
+  },
+
+  async getCurrentUser(): Promise<AuthenticatedUser> {
+    const { data } = await http.get<AuthenticatedUser>('/auth/me')
+    lastDataSource = 'backend'
+    return data
+  },
+
+  async changePassword(payload: ChangePasswordPayload): Promise<AuthenticatedUser> {
+    const { data } = await http.post<AuthenticatedUser>('/auth/change-password', payload)
+    lastDataSource = 'backend'
+    return data
+  },
+
+  async logout(): Promise<void> {
+    await http.post('/auth/logout')
+    lastDataSource = 'backend'
+  },
+
   async getDashboard(): Promise<DashboardSummary> {
     const [health, backendProjects, backendRuns, integrationConfig] = await Promise.all([
       fetchHealth(),

src/services/http.ts

@@ -9,6 +9,18 @@ export const http = axios.create({
   withCredentials: true,
 })
 
+/**
+ * 登录令牌只用于调用后端 API，不会传给 Jenkins/Gitea/LLM 等第三方服务。
+ */
+export function setAuthToken(token?: string) {
+  if (token) {
+    http.defaults.headers.common.Authorization = `Bearer ${token}`
+    return
+  }
+
+  delete http.defaults.headers.common.Authorization
+}
+
 http.interceptors.response.use(
   (response) => {
     response.data = unwrapApiPayload(response.data)