feat(web): W3-1 login, session shell, home dashboard, settings, engine panel and audit pages

- /login: setup/login/TOTP states driven by server error codes, fixed-height error slot
- console layout: GET /auth/session gate, redirect to /login, account popover (change password, logout)
- home: six dashboard sections with SSE-driven refresh, automation switch and read-only reconcile toggle
- settings tabs: downloaders, media servers, library roots, path mappings, site credentials,
  API keys (one-time plaintext), Pi upstream, cache/organize/retention/budget, automation
- engine: runs list (status/name filters, cursor paging, stats tiles), run detail (step timeline,
  json payloads, signals, cancel)
- audit: filterable list with detail sheet
- vite: allow repo root in server.fs so deno-installed deps under node_modules/.deno load in dev

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/instances.ts

@@ -0,0 +1,120 @@
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import type {
+  CursorPage,
+  DownloaderInstance,
+  DownloaderInstanceCreate,
+  DownloaderInstanceUpdate,
+  InstanceTestResult,
+  LibraryRoot,
+  LibraryRootCreate,
+  LibraryRootUpdate,
+  MediaServerInstance,
+  MediaServerInstanceCreate,
+  MediaServerInstanceUpdate,
+  PathMapping,
+  PathMappingCreate,
+  PathMappingUpdate,
+  Site,
+  SiteAccount,
+  SiteCredentialsPut,
+  SiteCredentialsResult,
+} from "@umt/contracts";
+import { apiData } from "~/lib/api.ts";
+import { type QueryArea, qk } from "~/lib/query-keys.ts";
+
+/** 实例类资源的标准 CRUD 钩子(列表取前 200 条,首版实例数量很少) */
+function crudHooks<Row extends { id: string }, Create, Update>(area: QueryArea, base: string) {
+  return {
+    useList: () =>
+      useQuery({
+        queryKey: qk.list(area),
+        queryFn: ({ signal }) => apiData<CursorPage<Row>>(base, { params: { limit: 200 }, signal }),
+      }),
+    useCreate: () => {
+      const qc = useQueryClient();
+      return useMutation({
+        mutationFn: (body: Create) => apiData<Row>(base, { method: "POST", body }),
+        onSuccess: () => qc.invalidateQueries({ queryKey: qk.all(area) }),
+      });
+    },
+    useUpdate: () => {
+      const qc = useQueryClient();
+      return useMutation({
+        mutationFn: ({ id, body }: { id: string; body: Update }) =>
+          apiData<Row>(`${base}/{id}`, { method: "PATCH", pathParams: { id }, body }),
+        onSuccess: () => qc.invalidateQueries({ queryKey: qk.all(area) }),
+      });
+    },
+    useRemove: () => {
+      const qc = useQueryClient();
+      return useMutation({
+        mutationFn: (id: string) => apiData<unknown>(`${base}/{id}`, { method: "DELETE", pathParams: { id } }),
+        onSuccess: () => qc.invalidateQueries({ queryKey: qk.all(area) }),
+      });
+    },
+  };
+}
+
+/** 连接测试 / 校验类动作(结果写回 health,完成后刷新列表) */
+function actionHook<R>(area: QueryArea, path: string) {
+  return () => {
+    const qc = useQueryClient();
+    return useMutation({
+      mutationFn: (id: string) => apiData<R>(path, { method: "POST", pathParams: { id }, body: {} }),
+      onSettled: () => qc.invalidateQueries({ queryKey: qk.all(area) }),
+    });
+  };
+}
+
+export const downloaders = {
+  ...crudHooks<DownloaderInstance, DownloaderInstanceCreate, DownloaderInstanceUpdate>(
+    "downloader-instances",
+    "/downloader-instances",
+  ),
+  useTest: actionHook<InstanceTestResult>("downloader-instances", "/downloader-instances/{id}/test"),
+};
+
+export const mediaServers = {
+  ...crudHooks<MediaServerInstance, MediaServerInstanceCreate, MediaServerInstanceUpdate>(
+    "media-server-instances",
+    "/media-server-instances",
+  ),
+  useTest: actionHook<InstanceTestResult>("media-server-instances", "/media-server-instances/{id}/test"),
+};
+
+export const libraryRoots = {
+  ...crudHooks<LibraryRoot, LibraryRootCreate, LibraryRootUpdate>("library-roots", "/library-roots"),
+  useTest: actionHook<InstanceTestResult>("library-roots", "/library-roots/{id}/test"),
+};
+
+export const pathMappings = {
+  ...crudHooks<PathMapping, PathMappingCreate, PathMappingUpdate>("path-mappings", "/path-mappings"),
+  useVerify: actionHook<PathMapping>("path-mappings", "/path-mappings/{id}/verify"),
+};
+
+// ─── 站点账号凭证(设置页录入;站点本身由站点工作台管理) ───
+
+export function useSiteOptions() {
+  return useQuery({
+    queryKey: qk.list("sites", { limit: 200 }),
+    queryFn: ({ signal }) => apiData<CursorPage<Site>>("/sites", { params: { limit: 200 }, signal }),
+  });
+}
+
+export function useSiteAccounts() {
+  return useQuery({
+    queryKey: qk.list("site-accounts"),
+    queryFn: ({ signal }) => apiData<CursorPage<SiteAccount>>("/site-accounts", { params: { limit: 200 }, signal }),
+  });
+}
+
+export function usePutSiteCredentials() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: ({ siteId, body }: { siteId: string; body: SiteCredentialsPut }) =>
+      apiData<SiteCredentialsResult>("/sites/{id}/credentials", { method: "PUT", pathParams: { id: siteId }, body }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: qk.all("site-accounts") });
+    },
+  });
+}