Merge branch 'master' into dhk-1

解决 8 处冲突：
- app.py：同时挂载 public_embed + html_page_favorites 两个 router
- .env：保留 dhk-1 的 CORS 配置（含 5174、ALLOW_ALL=0）
- message-list.tsx：并入双方新增（onSetupWriting* 解构 + contentClassName/fitMessageRowsToContent 类型）
- WorkspaceRoutes.tsx：采用 master 的路由结构（含 chats_iframe/IframeChatPage），补回 dhk-1 的 BusinessChainEditorPage 导入与 roundtable/chains 路由
- LoginPage.tsx：合并两套登录（master 的 token 换登录 + dhk-1 的 online-ticket），并集依赖数组
- ScheduledTasksPage.tsx：采用 master 的 HTML 定时任务表单（isHtmlTask 分支）
- AIWritingForm.tsx：保留 dhk-1 的 useWritingForm 重构，补回 master 的笔记来源 useState；WritingFormContext.materialSource 扩展支持 'notebook'
- useAIWritingStream.ts：保留 dhk-1 重构（仅 reducer/helpers，useAIWriting 已移至 AIWritingContext），不并入 master 在此文件的旧实现

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend-web/src/core/auth/api.ts

@@ -17,24 +17,70 @@ export async function listAllUsers(): Promise<UserListItem[]> {
   return res.json() as Promise<UserListItem[]>;
 }
 
+// Normalize a FastAPI error body into a human-readable string. `detail` may be
+// a plain string, an object like AuthErrorResponse ({ code, message }), or an
+// array of validation errors — anything but a string would otherwise render as
+// the dreaded "[object Object]".
+function extractErrorMessage(body: unknown, fallback = "Login failed."): string {
+  const detail = (body as { detail?: unknown } | null)?.detail ?? body;
+  if (typeof detail === "string") return detail;
+  if (Array.isArray(detail)) {
+    const msg = detail
+      .map((d) => (d && typeof d === "object" ? (d as { msg?: string }).msg : String(d)))
+      .filter(Boolean)
+      .join("; ");
+    return msg || fallback;
+  }
+  if (detail && typeof detail === "object") {
+    const obj = detail as { message?: string; msg?: string };
+    return obj.message ?? obj.msg ?? fallback;
+  }
+  return fallback;
+}
+
 export async function loginByUsername(
   username: string,
+  password?: string | null,
 ): Promise<LoginByUsernameResponse> {
+  // When the username-login password gate is enabled server-side, the shared
+  // secret must be passed as ?password=. Omitted when no password is provided
+  // so the passwordless flow keeps working unchanged.
+  const base = `${getBackendBaseURL()}/api/v1/auth/login/username`;
+  const url =
+    password != null && password !== ""
+      ? `${base}?password=${encodeURIComponent(password)}`
+      : base;
+  const response = await apiFetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ username }),
+  });
+  if (!response.ok) {
+    const error = await response.json().catch(() => null);
+    throw new Error(extractErrorMessage(error));
+  }
+  return response.json() as Promise<LoginByUsernameResponse>;
+}
+
+export async function loginByToken(
+  token: string,
+): Promise<LoginByUsernameResponse> {
+  // Token-exchange login: the gateway resolves the upstream token to a username
+  // and signs the matching local account in.
   const response = await apiFetch(
-    `${getBackendBaseURL()}/api/v1/auth/login/username`,
+    `${getBackendBaseURL()}/api/v1/auth/login/token?token=${encodeURIComponent(token)}`,
     {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
       },
-      body: JSON.stringify({ username }),
     },
   );
   if (!response.ok) {
-    const error = await response
-      .json()
-      .catch(() => ({ detail: "Login failed." }));
-    throw new Error(error.detail ?? "Login failed.");
+    const error = await response.json().catch(() => null);
+    throw new Error(extractErrorMessage(error));
   }
   return response.json() as Promise<LoginByUsernameResponse>;
 }