feat(web): W3-1 login, session shell, home dashboard, settings, engine panel and audit pages

- /login: setup/login/TOTP states driven by server error codes, fixed-height error slot
- console layout: GET /auth/session gate, redirect to /login, account popover (change password, logout)
- home: six dashboard sections with SSE-driven refresh, automation switch and read-only reconcile toggle
- settings tabs: downloaders, media servers, library roots, path mappings, site credentials,
  API keys (one-time plaintext), Pi upstream, cache/organize/retention/budget, automation
- engine: runs list (status/name filters, cursor paging, stats tiles), run detail (step timeline,
  json payloads, signals, cancel)
- audit: filterable list with detail sheet
- vite: allow repo root in server.fs so deno-installed deps under node_modules/.deno load in dev

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/auth.ts

@@ -0,0 +1,69 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import type {
+  AdminSetupRequest,
+  LoginRequest,
+  LoginResult,
+  PasswordChangeRequest,
+  PasswordChangeResult,
+  SessionInfo,
+  TotpAction,
+  TotpActionResult,
+  TotpStatus,
+} from "@umt/contracts";
+import { ApiRequestError, apiData, apiFetch } from "~/lib/api.ts";
+import { qk } from "~/lib/query-keys.ts";
+
+/** 登录态探测(免鉴权,不触发 401 跳转) */
+export function useSession() {
+  return useQuery({
+    queryKey: qk.session,
+    queryFn: ({ signal }) => apiData<SessionInfo>("/auth/session", { signal, noAuthRedirect: true }),
+    staleTime: 60_000,
+    retry: 1,
+  });
+}
+
+/** 登录/初始化类请求:返回错误码(由调用方按码分流文案),不跳转 */
+async function authPost<T>(path: string, body: unknown): Promise<T> {
+  const r = await apiFetch<T>(path, { method: "POST", body, noAuthRedirect: true });
+  if (!r.ok) throw new ApiRequestError(r.error.code, r.error.message);
+  return r.data;
+}
+
+export const login = (body: LoginRequest) => authPost<LoginResult>("/auth/login", body);
+export const setupAdmin = (body: AdminSetupRequest) => authPost<SessionInfo>("/auth/setup", body);
+
+export function useLogout() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: () => authPost<unknown>("/auth/logout", {}),
+    onSettled: () => {
+      qc.clear();
+    },
+  });
+}
+
+export function useChangePassword() {
+  return useMutation({
+    mutationFn: (body: PasswordChangeRequest) =>
+      apiData<PasswordChangeResult>("/auth/password", { method: "POST", body }),
+  });
+}
+
+export function useTotpStatus(enabled = true) {
+  return useQuery({
+    queryKey: qk.sub("auth", "totp"),
+    queryFn: ({ signal }) => apiData<TotpStatus>("/auth/totp", { signal }),
+    enabled,
+  });
+}
+
+export function useTotpAction() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: (body: TotpAction) => apiData<TotpActionResult>("/auth/totp", { method: "POST", body }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: qk.all("auth") });
+    },
+  });
+}