feat: align portal center panel with side cards + redesign login page

- Portal: wrap .panel-head in matching card (border, radius, shadow) with
  cyan->purple left accent bar; h2 28px -> 20px; description right-aligned
  with vertical divider; top edge now aligns with side-menu & links-panel
- Login: switch from absolute-positioned icons to el-input prefix slot;
  layout brand row (logo + title + uppercase subtitle); add form-title
  section with gradient bar; consistent cyan focus; gradient button;
  dashed top divider for back-link; card width 420 -> 460
- Add .gitignore (node_modules, dist, __pycache__, .env, etc.)

backend/auth.py

@@ -0,0 +1,45 @@
+"""Auth helpers: JWT issue/verify + admin guard."""
+import functools
+from datetime import datetime, timedelta, timezone
+
+import jwt
+from flask import current_app, jsonify, request
+
+from models import User
+
+
+def issue_token(user):
+    payload = {
+        "user_id": user.id,
+        "username": user.username,
+        "exp": datetime.now(timezone.utc) + timedelta(hours=current_app.config["JWT_EXPIRE_HOURS"]),
+        "iat": datetime.now(timezone.utc),
+    }
+    return jwt.encode(payload, current_app.config["SECRET_KEY"], algorithm="HS256")
+
+
+def decode_token(token):
+    try:
+        return jwt.decode(token, current_app.config["SECRET_KEY"], algorithms=["HS256"])
+    except jwt.PyJWTError:
+        return None
+
+
+def get_current_user():
+    auth = request.headers.get("Authorization", "")
+    if not auth.startswith("Bearer "):
+        return None
+    payload = decode_token(auth[7:])
+    if not payload:
+        return None
+    return User.query.get(payload["user_id"])
+
+
+def admin_required(fn):
+    @functools.wraps(fn)
+    def wrapper(*args, **kwargs):
+        user = get_current_user()
+        if not user:
+            return jsonify({"error": "未登录或登录已过期"}), 401
+        return fn(*args, **kwargs)
+    return wrapper