feat: add password change settings

frontend/src/MvpPanel.vue

@@ -24,6 +24,11 @@ const habitNameInput = ref<HTMLInputElement | null>(null)
 const importFile = ref<File | null>(null)
 const importPreview = ref<any>(null)
 const restoreFile = ref<File | null>(null)
+const currentPassword = ref('')
+const newPassword = ref('')
+const confirmPassword = ref('')
+const passwordBusy = ref(false)
+const passwordError = ref('')
 const todayKey = ref(dateKey(new Date()))
 const habitSwipeStart = ref<{ id: string; x: number; y: number } | null>(null)
 const habitPointerStart = ref<{ id: string; x: number; y: number } | null>(null)
@@ -286,6 +291,33 @@ async function restore() {
     emit('changed'); emit('notice', '数据已恢复')
   })
 }
+async function changePassword() {
+  passwordError.value = ''
+  if (newPassword.value !== confirmPassword.value) {
+    passwordError.value = '两次输入的新密码不一致'
+    return
+  }
+  if (newPassword.value.length < 12) {
+    passwordError.value = '新密码至少需要 12 位'
+    return
+  }
+  passwordBusy.value = true
+  try {
+    await request('/auth/change-password', {
+      method: 'POST',
+      body: JSON.stringify({ current_password: currentPassword.value, new_password: newPassword.value }),
+    })
+    currentPassword.value = ''
+    newPassword.value = ''
+    confirmPassword.value = ''
+    emit('notice', '密码已修改，其他设备已退出登录')
+    await loadSettings()
+  } catch (e) {
+    passwordError.value = e instanceof Error ? e.message : '修改密码失败'
+  } finally {
+    passwordBusy.value = false
+  }
+}
 onMounted(() => {
   if (props.view === 'habits' || props.view === 'today-habits') {
     refreshHabitDay()
@@ -357,6 +389,7 @@ onBeforeUnmount(() => {
       <div class="settings-grid">
         <article class="tool-card"><FileJson /><h3>数据导出与恢复</h3><p>下载完整 JSON 备份，或从备份恢复。</p><button class="soft-button" @click="exportData"><Download />导出 JSON</button><label class="file-button"><ArchiveRestore />选择备份<input type="file" accept="application/json" @change="restoreFile=($event.target as HTMLInputElement).files?.[0]||null"></label><button v-if="restoreFile" class="danger-button" @click="restore">确认恢复</button></article>
         <article class="tool-card"><Upload /><h3>导入</h3><p>先预览变化，确认后才写入。</p><label class="file-button">选择文件<input type="file" accept=".json,.csv" @change="importFile=($event.target as HTMLInputElement).files?.[0]||null"></label><button :disabled="!importFile" class="soft-button" @click="previewImport">生成预览</button><pre v-if="importPreview">{{ JSON.stringify(importPreview, null, 2) }}</pre><button v-if="importPreview" class="primary-small" @click="confirmImport">确认导入</button></article>
+        <article class="tool-card password-card"><Activity /><h3>修改密码</h3><p>修改后当前设备保持登录，其他设备会自动退出。</p><form class="password-form" @submit.prevent="changePassword"><label>当前密码<input v-model="currentPassword" type="password" autocomplete="current-password" required aria-label="当前密码"></label><label>新密码<input v-model="newPassword" type="password" autocomplete="new-password" minlength="12" required aria-label="新密码" placeholder="至少 12 位"></label><label>确认新密码<input v-model="confirmPassword" type="password" autocomplete="new-password" minlength="12" required aria-label="确认新密码"></label><p v-if="passwordError" class="inline-error" role="alert">{{passwordError}}</p><button class="primary-small" :disabled="passwordBusy || !currentPassword || !newPassword || !confirmPassword">{{passwordBusy?'正在修改…':'修改密码'}}</button></form></article>
         <article class="tool-card wide"><LogOut /><h3>登录会话</h3><div v-for="s in sessions" :key="s.id" class="session-row"><span><b>{{ s.current ? '当前设备' : '其他设备' }}</b><small>{{ s.user_agent || '未知设备' }} · {{ s.last_seen_at || s.created_at }}</small></span><button v-if="!s.current" class="danger-text" @click="revoke(s.id)">撤销</button></div><p v-if="!sessions.length">没有可显示的会话。</p></article>
         <article v-if="audit.length" class="tool-card wide"><Activity /><h3>最近活动</h3><div v-for="(row, i) in audit" :key="row.id || i" class="audit-row"><span>{{ row.action || row.event || '变更' }}</span><small>{{ row.created_at || row.timestamp }}</small></div></article>
       </div>

frontend/src/style.css

@@ -25,7 +25,7 @@ main{min-width:0;padding:27px 34px 50px;overflow:auto;background:linear-gradient
 .numeric-action{display:flex;gap:6px;align-items:center}.numeric-action input{width:74px;border:1px solid var(--line);border-radius:8px;padding:7px;background:#fff}.numeric-action .soft-button{min-height:44px;padding:9px 12px}
 .habit-row>.icon.ghost{width:44px;height:44px;flex:0 0 44px}.habit-check{margin-left:-4px}.habit-row.done .habit-check .task-check-mark{background:#71856b;border-color:#71856b;color:#fff}.habit-toolbar{display:flex;align-items:center;gap:12px;justify-content:flex-end;color:var(--muted);font-size:12px}.habit-toolbar label{display:inline-flex;align-items:center;gap:6px}.habit-toolbar input{margin:0}.habit-toolbar-today{justify-content:flex-start;margin:0 0 2px 2px}
 .empty-panel{text-align:center;color:var(--muted);display:grid;place-items:center;gap:10px}.today-empty-panel{min-height:130px}.empty-action{margin-top:4px;color:#655d52}.empty-action svg{width:15px;height:15px}
-.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px}.tool-card{display:flex;flex-direction:column;align-items:flex-start;gap:10px}.tool-card>svg{color:var(--accent);width:25px;height:25px}.tool-card p{margin:0;color:var(--muted);font-size:13px}.tool-card.wide{grid-column:1/-1}.file-button input{display:none}.tool-card pre{width:100%;max-height:180px;overflow:auto;background:#f8f3e8;padding:10px;border-radius:8px;font-size:10px}.session-row,.audit-row{width:100%;display:flex;justify-content:space-between;align-items:center;border-top:1px solid var(--line);padding:9px 0}.session-row span{display:grid}.session-row small,.audit-row small{color:var(--muted);font-size:11px}.inline-error{padding:9px;border-radius:8px;color:var(--danger);background:#fff0ed}.settings.active{background:var(--accent-soft);color:#b7421e;font-weight:700}
+.settings-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px}.tool-card{display:flex;flex-direction:column;align-items:flex-start;gap:10px}.tool-card>svg{color:var(--accent);width:25px;height:25px}.tool-card p{margin:0;color:var(--muted);font-size:13px}.tool-card.wide{grid-column:1/-1}.password-form{width:100%;display:grid;gap:10px}.password-form label{display:grid;gap:6px;color:#675f54;font-size:12px;font-weight:650}.password-form input{width:100%;border:1px solid var(--line);background:#fff;border-radius:10px;padding:11px 12px;outline:none}.password-form input:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(241,90,41,.1)}.password-form button{justify-self:start}.file-button input{display:none}.tool-card pre{width:100%;max-height:180px;overflow:auto;background:#f8f3e8;padding:10px;border-radius:8px;font-size:10px}.session-row,.audit-row{width:100%;display:flex;justify-content:space-between;align-items:center;border-top:1px solid var(--line);padding:9px 0}.session-row span{display:grid}.session-row small,.audit-row small{color:var(--muted);font-size:11px}.inline-error{padding:9px;border-radius:8px;color:var(--danger);background:#fff0ed}.settings.active{background:var(--accent-soft);color:#b7421e;font-weight:700}
 @media(max-width:800px){.settings-grid{grid-template-columns:1fr}.tool-card.wide{grid-column:auto}.habit-row{padding:5px 4px 5px 8px}.habit-main{padding:10px 2px}.numeric-action input{width:62px}}
 .unified-fab{display:grid;place-items:center;position:fixed;z-index:60;right:20px;bottom:22px;width:56px;height:56px;border:0;border-radius:50%;background:var(--accent);color:#fff;box-shadow:0 8px 20px rgba(241,90,41,.28);transition:transform .16s ease,box-shadow .16s ease;touch-action:none;user-select:none}.unified-fab svg{width:25px;height:25px}.unified-fab:hover{transform:translateY(-2px);box-shadow:0 10px 24px rgba(241,90,41,.32)}.unified-fab:active{transform:scale(.96)}.unified-fab.dragging{transform:scale(1.06);box-shadow:0 12px 28px rgba(241,90,41,.36)}.task-compose-mask{position:fixed;z-index:70;inset:0;background:rgba(45,38,31,.34);display:flex;align-items:flex-end;padding:0}.task-compose-sheet{width:100%;max-height:min(88dvh,720px);overflow:auto;background:#fffdf8;border-radius:24px 24px 0 0;padding:18px 18px calc(20px + env(safe-area-inset-bottom));box-shadow:0 -16px 42px rgba(56,40,24,.2);display:grid;gap:14px;transform-origin:var(--fab-origin-x,calc(100% - 44px)) var(--fab-origin-y,100%)}.task-compose-sheet header{display:flex;align-items:center;justify-content:space-between}.task-compose-sheet header small{color:var(--accent);font-size:10px;font-weight:800;letter-spacing:.12em}.task-compose-sheet h2{margin:2px 0 0;font-size:22px}.task-compose-sheet label{display:grid;gap:6px;color:#675f54;font-size:12px;font-weight:650}.task-compose-sheet input,.task-compose-sheet select,.task-compose-sheet textarea{width:100%;border:1px solid var(--line);background:#fff;border-radius:11px;padding:12px;outline:none;resize:vertical}.task-compose-sheet input:focus,.task-compose-sheet select:focus,.task-compose-sheet textarea:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(241,90,41,.1)}.task-compose-row{display:grid;grid-template-columns:minmax(0,1fr) 105px;gap:10px}.task-compose-sheet footer{display:flex;justify-content:flex-end;gap:9px;padding-top:4px}.task-compose-sheet button:disabled{opacity:.45}.task-compose-enter-active,.task-compose-leave-active{transition:background .22s ease}.task-compose-enter-active .task-compose-sheet,.task-compose-leave-active .task-compose-sheet{transition:transform .28s cubic-bezier(.2,.9,.25,1.08),opacity .2s ease}.task-compose-enter-from,.task-compose-leave-to{background:rgba(45,38,31,0)}.task-compose-enter-from .task-compose-sheet,.task-compose-leave-to .task-compose-sheet{transform:translateY(36px) scale(.86);opacity:0}
 .countdown-compose-enter-active,.countdown-compose-leave-active{transition:background .24s ease}.countdown-compose-enter-active .countdown-modal,.countdown-compose-leave-active .countdown-modal{transition:transform .34s cubic-bezier(.18,.9,.28,1.16),opacity .22s ease,filter .22s ease;transform-origin:var(--fab-origin-x,calc(100% - 43px)) var(--fab-origin-y,calc(100% - 104px))}.countdown-compose-enter-from,.countdown-compose-leave-to{background:rgba(45,38,31,0)}.countdown-compose-enter-from .countdown-modal,.countdown-compose-leave-to .countdown-modal{transform:translate(20px,28px) scale(.18) rotate(8deg);opacity:0;filter:blur(5px)}@media(max-width:930px){.unified-fab{bottom:calc(82px + env(safe-area-inset-bottom))}}@media(prefers-reduced-motion:reduce){*,*:before,*:after{scroll-behavior:auto!important;animation-duration:.01ms!important;transition-duration:.01ms!important}}

frontend/src/style.test.ts

@@ -117,6 +117,16 @@ describe('task and habit row decoration', () => {
     expect(mvpPanel).not.toContain("view === 'today-habits' && busy\" class=\"empty-panel\">加载中…")
   })
 
+  it('shows a password form with confirmation and calls the protected endpoint', () => {
+    expect(mvpPanel).toContain('class="password-form"')
+    expect(mvpPanel).toContain('aria-label="当前密码"')
+    expect(mvpPanel).toContain('aria-label="新密码"')
+    expect(mvpPanel).toContain('aria-label="确认新密码"')
+    expect(mvpPanel).toContain("request('/auth/change-password'")
+    expect(mvpPanel).toContain('两次输入的新密码不一致')
+    expect(css).toContain('.password-form{width:100%;display:grid;gap:10px}')
+  })
+
   it('keeps habit cards borderless so the rounded left edge has no visual gap', () => {
     expect(css).toMatch(/\.habit-row\{border:0;/)
     expect(css).not.toMatch(/\.habit-row\{[^}]*border-top:/)