后台登录改造：自建登录页 + Cookie 会话，弃用 basic auth 弹窗

- editor-api 新增 /admin/login|session|logout：HttpOnly Cookie 会话（落盘持久化）、
  登录失败限速（5 次锁 5 分钟）、鉴权改为「X-Editor-Token 或 会话」双通道
- 登录页重做：品牌标识、图标输入框、密码可见切换、柔光背景，深浅色适配
- 前端以 /admin/session 探测部署模式：国内机走本机会话，CF 版走原令牌流程
- nginx：/admin/ 与 /api/v2/editor/ 去掉 basic auth 与令牌注入，登录凭据只存 Cookie
- bootstrap.sh 同步 ADMIN_USER/ADMIN_PASS，保持一键迁移能力

blog-admin/public/admin/index.html

@@ -16,25 +16,57 @@
 <!-- ===================== 登录 ===================== -->
 <div id="gate" class="gate" hidden>
   <div class="login-card">
-    <h1>管理面板</h1>
-    <p class="sub">优世界 · 评论 + 订阅统一管理</p>
+
+    <div class="login-brand">
+      <span class="lb-mark">优</span>
+      <div class="lb-text">
+        <strong>优世界</strong>
+        <span>管理面板</span>
+      </div>
+    </div>
+
+    <div class="login-head">
+      <h1>欢迎回来</h1>
+      <p class="sub">登录后管理评论、订阅与文章</p>
+    </div>
 
     <div id="lgErr" class="alert" hidden></div>
 
     <form id="loginForm">
-      <label class="lbl" for="lgUser">账号</label>
-      <input id="lgUser" type="text" placeholder="admin" required autocomplete="username" spellcheck="false">
+      <div class="field">
+        <label class="lbl" for="lgUser">账号</label>
+        <div class="lg-input">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 12.2a3.6 3.6 0 1 0 0-7.2 3.6 3.6 0 0 0 0 7.2z"/><path d="M4.8 20.2a7.2 7.2 0 0 1 14.4 0"/></svg>
+          <input id="lgUser" type="text" placeholder="请输入账号" required autocomplete="username" spellcheck="false">
+        </div>
+      </div>
 
-      <label class="lbl" for="lgPass">密码</label>
-      <input id="lgPass" type="password" required autocomplete="current-password">
+      <div class="field">
+        <label class="lbl" for="lgPass">密码</label>
+        <div class="lg-input has-peek">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="4.6" y="10.4" width="14.8" height="9.6" rx="2.2"/><path d="M8.2 10.4V7.9a3.8 3.8 0 0 1 7.6 0v2.5"/><path d="M12 14.2v2.2"/></svg>
+          <input id="lgPass" type="password" placeholder="请输入密码" required autocomplete="current-password">
+          <button type="button" class="lg-peek" data-act="peek-pass" aria-label="显示密码" aria-pressed="false">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.6 12S6.1 6 12 6s9.4 6 9.4 6-3.5 6-9.4 6-9.4-6-9.4-6z"/><circle cx="12" cy="12" r="2.7"/></svg>
+          </button>
+        </div>
+      </div>
 
-      <label class="lbl" for="lgRss">订阅口令（管理订阅/友链用，留空则跳过）</label>
-      <input id="lgRss" type="password" autocomplete="off">
+      <div class="field" id="lgRssField">
+        <label class="lbl" for="lgRss">订阅口令 <span class="lg-opt">可选</span></label>
+        <div class="lg-input">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8.2" cy="15.4" r="3.2"/><path d="M10.6 12.9 19.2 4.4"/><path d="M16.4 7.2l2.4 2.4"/><path d="M14 9.6l2.4 2.4"/></svg>
+          <input id="lgRss" type="password" placeholder="管理订阅 / 友链用，留空则跳过" autocomplete="off">
+        </div>
+      </div>
 
-      <button class="btn primary block" type="submit" id="lgBtn">登 录</button>
+      <button class="btn primary block lg-submit" type="submit" id="lgBtn">登 录</button>
     </form>
 
-    <p class="hint" title="Cloudflare Workers 没有 TCP，发不了 SMTP">邮箱验证码登录未启用</p>
+    <div class="login-foot">
+      <span class="lg-dot" aria-hidden="true"></span>
+      <span id="lgFoot">优世界 · 评论与订阅统一管理</span>
+    </div>
   </div>
 </div>