feat: add database-backed console login

internal/transport/httpserver/server.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
+	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
 	"git.yuntuo.hk/k2safe/orbit/internal/observability"
 	"git.yuntuo.hk/k2safe/orbit/pulse/service"
 )
@@ -48,6 +49,16 @@ func (r *Readiness) BeginDrain() {
 }
 
 func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
+	return newServer(addr, ready, nil, tasks...)
+}
+
+// NewWithConsoleAuth 创建带数据库控制台登录会话的 HTTP 服务。
+// 保留 New 供只测试 API 的调用方使用；生产入口应传入 ConsoleAuthStore。
+func NewWithConsoleAuth(addr string, ready Checker, consoleAuth consoleauth.Store, tasks ...*service.Service) *http.Server {
+	return newServer(addr, ready, consoleAuth, tasks...)
+}
+
+func newServer(addr string, ready Checker, consoleAuth consoleauth.Store, tasks ...*service.Service) *http.Server {
 	mux := http.NewServeMux()
 	write := func(w http.ResponseWriter, status int, body map[string]string) {
 		// 探针响应不能被代理或浏览器缓存，否则下线节点可能继续被路由流量。
@@ -83,10 +94,19 @@ func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
 		registerHistory(mux, tasks[0])
 	}
 	server := &http.Server{Addr: addr, Handler: mux, ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 10 * time.Second, WriteTimeout: 15 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 16 << 10}
-	RegisterConsole(server)
+	RegisterConsole(server, consoleAuth)
 	return server
 }
 
+// WrapConsoleAuth 必须在所有 Register* 路由完成后调用，因为路由注册器需要
+// 直接访问底层 ServeMux；包装完成后，浏览器会话才会转换为内部 Bearer 请求。
+func WrapConsoleAuth(server *http.Server, consoleAuth consoleauth.Store) {
+	if server == nil || consoleAuth == nil {
+		return
+	}
+	server.Handler = ConsoleSessionMiddleware(server.Handler, consoleAuth)
+}
+
 // WrapMetrics must run after all Register* functions because those functions
 // intentionally register routes on the underlying ServeMux.
 func WrapMetrics(server *http.Server, metrics *observability.Registry) {