Add cert+password dual-factor VPN authentication

OpenVPN now requires BOTH a valid client certificate AND a
username/password to establish a VPN connection.

Architecture:
  Client .ovpn has 'auth-user-pass' → prompts for credentials
  Server.conf has 'auth-user-pass-verify verify.sh via-env'
  verify.sh (bash+curl) calls POST /api/vpn/verify on the manager
  Manager verifies bcrypt hash via Go's golang.org/x/crypto/bcrypt
  Endpoint is localhost-only (127.0.0.1) for security

Model changes:
  Instance: new AuthMode field ('cert' | 'cert+password', default cert+password)
  VPNUser:  new PasswordHash (bcrypt) + Password (plaintext, transient)

Backend:
  model: AuthMode type, VPNUser.PasswordHash, VPNUser.Password (transient)
  store: ListUsers clears PasswordHash before returning
  service: CreateUser hashes password with bcrypt, enforces min 4 chars
  service: ResetVPNPassword for admin password reset
  service: UpdateUser preserves PasswordHash from old record
  service: CreateInstance defaults AuthMode=cert+password
  api: POST /api/vpn/verify (no JWT, localhost-only, bcrypt verify)
  api: POST /instances/:id/users/:uid/password (admin reset VPN pwd)
  openvpn: WriteVerifyScript generates bash+curl verify script
  openvpn: WriteServerConf adds script-security/auth-user-pass-verify
  openvpn: GenerateClientOVPN adds auth-user-pass directive

Frontend:
  Users.vue: password field on create form
  Users.vue: '重置密码' button in table + dialog
  Users.vue: '证书+密码' tag in auth column
  api: Inst.resetVPNPassword() method

Security:
  /api/vpn/verify rejects non-127.0.0.1 clients (403)
  PasswordHash never exposed via any API response
  verify.sh uses localhost curl (no external dependencies)
  bcrypt cost=10 (same as admin passwords)

Verified: correct pwd → 200, wrong pwd → 401, missing user → 401,
non-localhost → 403, .ovpn has auth-user-pass, server.conf has
script-security 2 + auth-user-pass-verify + verify-client-cert require.

backend/internal/model/model.go

@@ -13,6 +13,16 @@ const (
 	AccessWhitelist AccessMode = "whitelist"
 )
 
+// AuthMode 控制客户端认证方式。
+// - "cert":          仅证书认证(向后兼容)
+// - "cert+password": 证书 + 用户名密码双因素认证(更安全)
+type AuthMode string
+
+const (
+	AuthCert         AuthMode = "cert"
+	AuthCertPassword AuthMode = "cert+password"
+)
+
 // Instance 一个 OpenVPN 服务端实例。
 // 每个实例使用独立端口与 PKI，运行在自己的 server.conf 下，
 // 由 systemd 单元(或后台进程)托管，本服务通过 management 接口与之通信。
@@ -30,6 +40,7 @@ type Instance struct {
 	Extra         string     `json:"extra"`         // 用户追加配置
 	AccessMode    AccessMode `json:"access_mode"`   // open | whitelist
 	AllowNetworks []string   `json:"allow_networks"` // 实例级白名单 CIDR 列表
+	AuthMode      AuthMode   `json:"auth_mode"`     // cert | cert+password
 	Status        string     `json:"status"`        // running/stopped/error
 	PID           int        `json:"pid"`
 	CreatedAt     time.Time  `json:"created_at"`
@@ -41,7 +52,9 @@ type Instance struct {
 type VPNUser struct {
 	ID            string     `json:"id"`
 	InstanceID    string     `json:"instance_id"`
-	Username      string     `json:"username"`       // 证书 CN
+	Username      string     `json:"username"`       // 证书 CN, 同时也是 VPN 登录用户名
+	Password      string     `json:"password,omitempty"` // 明文密码(仅创建/重置时传入,不持久化)
+	PasswordHash  string     `json:"password_hash"` // bcrypt 哈希;store.ListUsers 返回时清空
 	RealName      string     `json:"real_name"`      // 备注
 	Email         string     `json:"email"`
 	Enabled       bool       `json:"enabled"`        // 是否启用, false 即吊销/禁用