管理员智能体/技能管理 + 跨标签登录同步 + 上游响应异常重试

- 「设置和更多」新增「智能体管理」「技能管理」入口，与定时任务管理同级；
  独立的 AdminAgentsPage/AdminSkillsPage 复用 AgentCard/SkillRow，
  管理员可查看并编辑/删除所有用户的智能体与技能。
- 后端 /api/agents、/api/skills 增加 ?admin=true 越权列表；agents 端
  放宽 _get_editable_or_raise 让管理员可编辑/删除任意智能体；新增
  list_all/update_any/delete_any（agents）与 list_all（skills）。
- 新增 AuthSyncWatcher：监听 localStorage["deerflow.auth"] 的 storage
  事件，user_id 变化时自动 reload，修复多标签切换登录后老页面点击
  「新对话」偶发 404 的问题。
- LLMErrorHandlingMiddleware 将 bad_response_status_code / JSON
  decode 等上游网关乱码识别为可重试的 upstream 类故障。
- 侧边栏「任务管理」改名为「定时任务」。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

offline-backend-20260512/backend/app/gateway/routers/agents.py

@@ -297,17 +297,21 @@ async def _get_editable_or_raise(
 ) -> tuple[dict[str, Any], str]:
     """Return (record, edit_mode) where edit_mode is 'owner' or 'admin'.
 
-    'admin' is granted only when the agent is built-in (user_id IS NULL) and the
-    caller is a system admin. Custom agents owned by other users still 403.
+    Admins may edit any agent — built-in (``user_id IS NULL``) or owned by
+    another user — so the admin console can manage the full agent catalog.
+    Non-admin callers are still restricted to agents they own.
     """
     owned = await store.get_owned(agent_id, user_id)
     if owned is not None:
         return owned, "owner"
+    if is_admin:
+        record = await store.get_any(agent_id)
+        if record is None:
+            raise HTTPException(status_code=404, detail=f"Agent '{agent_id}' not found")
+        return record, "admin"
     visible = await store.get_visible(agent_id, user_id)
     if visible is None:
         raise HTTPException(status_code=404, detail=f"Agent '{agent_id}' not found")
-    if is_admin and visible.get("user_id") is None:
-        return visible, "admin"
     raise HTTPException(status_code=403, detail="You can only modify agents that you created")
 
 
@@ -321,6 +325,14 @@ async def list_agents(
     request: Request,
     search: str | None = Query(default=None, description="Case-insensitive fuzzy match on agent name"),
     tag_ids: list[str] | None = Query(default=None, description="Keep agents carrying any of these tags (OR)"),
+    admin: bool = Query(
+        default=False,
+        description=(
+            "Admin-only override. When ``true`` and the caller is a system admin, "
+            "every agent is returned (built-in + every user's agents + private-square "
+            "entries) regardless of the usual ownership/visibility filter."
+        ),
+    ),
 ) -> AgentsListResponse:
     _require_agents_api_enabled()
 
@@ -329,7 +341,12 @@ async def list_agents(
         tag_store: TagStore = get_tag_store(request)
         await _sync_legacy_agents(store)
         user_id = _current_user_id(request)
-        agents = await store.list_visible(user_id)
+        if admin:
+            if not _is_admin_user(request):
+                raise HTTPException(status_code=403, detail="Only system admins can list all agents")
+            agents = await store.list_all()
+        else:
+            agents = await store.list_visible(user_id)
         responses = [_record_to_response(a, include_soul=True) for a in agents]
 
         assignments = await tag_store.list_assignments("agent", [r.id for r in responses])
@@ -527,7 +544,10 @@ async def update_agent(agent_id: str, request: AgentUpdateRequest, http_request:
         if not update_data:
             record = current
         elif edit_mode == "admin":
-            record = await store.update_builtin(agent_id, update_data)
+            # Admins may edit built-in (``user_id IS NULL``) and any user-owned
+            # agent — ``update_any`` skips the ownership check that ``update``
+            # and ``update_builtin`` enforce.
+            record = await store.update_any(agent_id, update_data)
         else:
             record = await store.update(agent_id, user_id, update_data)
         if record is None:
@@ -614,7 +634,7 @@ async def delete_agent(agent_id: str, request: Request) -> None:
         )
 
         if edit_mode == "admin":
-            deleted = await store.delete_builtin(agent_id)
+            deleted = await store.delete_any(agent_id)
         else:
             deleted = await store.delete(agent_id, user_id)
         if not deleted:

offline-backend-20260512/backend/app/gateway/routers/skills.py

@@ -695,11 +695,25 @@ async def list_skills(
     tag_store: TagStore = Depends(get_tag_store),
     search: str | None = Query(default=None, description="Case-insensitive fuzzy match on skill name"),
     tag_ids: list[str] | None = Query(default=None, description="Keep skills carrying any of these tags (OR)"),
+    admin: bool = Query(
+        default=False,
+        description=(
+            "Admin-only override. When ``true`` and the caller is a system admin, "
+            "every custom skill is returned (including unpublished skills owned by "
+            "other users) regardless of the usual ownership filter."
+        ),
+    ),
 ) -> SkillsListResponse:
     try:
         user_id = _current_user_id(request)
+        if admin and not _is_admin_user(request):
+            raise HTTPException(status_code=403, detail="Only system admins can list all skills")
         all_skills = get_or_new_skill_storage(app_config=config).load_skills(enabled_only=False)
-        ownership = await _build_ownership_index(skill_store, user_id)
+        if admin:
+            ownership_records = await skill_store.list_all()
+            ownership = {record["name"]: record for record in ownership_records}
+        else:
+            ownership = await _build_ownership_index(skill_store, user_id)
         display_adapters = await _list_skill_display_adapters([skill.name for skill in all_skills])
         responses: list[SkillResponse] = []
         for skill in all_skills:
@@ -720,7 +734,11 @@ async def list_skills(
                 continue
             record = ownership.get(skill.name)
             if record is None:
-                continue
+                if not admin:
+                    continue
+                # Admin sees every custom skill on disk even without an
+                # ownership row (legacy / orphaned), so they can clean it up.
+                record = None
             responses.append(
                 _skill_to_response(
                     skill,
@@ -731,6 +749,8 @@ async def list_skills(
             )
         responses = await _attach_and_filter_tags(tag_store, responses, search, tag_ids)
         return SkillsListResponse(skills=responses)
+    except HTTPException:
+        raise
     except Exception as e:
         logger.error(f"Failed to load skills: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail=f"Failed to load skills: {str(e)}")