feat: complete Vue UI parity (full backend + frontend)

== New domain models (7) ==
- UserPermission: per-user feature toggles (13 booleans)
- StorageConfig: encrypted Alist/S3/WebDAV adapters
- LicenseKey + LicenseActivation: offline license issuance
- DownloadClient: multi-client downloader configs
- AssistantSession + AssistantMessage: multi-turn AI chat persistence

== New services (5) ==
- PermissionService: admin grants always-true; user defaults seeded
- StorageConfigService: AES-GCM encryption + per-type connection probe
- LicenseService: 24-char hyphenated key generation, activation/heartbeat
- DownloadClientService: qB/Aria2/Transmission CRUD + WebUI test
- AssistantService: chat history + execute/undo stubs (op_id tracking)

== Extended AIService.Chat ==
- Multi-turn LLM call with chat history; offline fallback reply

== New endpoints (60+) ==
Auth:
  POST /auth/refresh, /auth/logout, /auth/change-password
  PATCH /auth/profile
  GET /auth/permissions, /auth/me

Permissions admin:
  GET/PUT /admin/users/:id/permissions
  POST /admin/users/:id/permissions/reset

Search:
  GET /search, /search/advanced, /search/tmdb, /search/sites

System:
  GET /system/config, /settings/schema, /system/events/ticket
  POST /admin/system/scheduler/:name/trigger

Stats:
  GET /stats/user/:id, /stats/top-users
  POST /stats/play

Sites:
  GET /sites/:id/resource, /sites/:id/userdata

Subscriptions:
  PUT /subscriptions/:id, POST /subscriptions/:id/search

Playlists:
  POST /playlists/:id/reorder
  DELETE /playlists/:id/items/by-id/:item_id

DLNA per-renderer:
  POST /dlna/:uuid/{play,pause,stop}, GET /dlna/:uuid/status

Media:
  POST/DELETE /media/:id/favorite, GET /media/:id/favorite/status
  POST /media/:id/ai-scrape, /media/scrape/test, /media/organize
  GET /favorites (alias)

Playback:
  GET /playback/:id/info, /playback/:id/external-players, /playback/:id/external-url
  POST /playback/:id/progress
  GET /playback/transcode/:job_id/status

Downloads:
  POST /download/:id/{pause,resume,organize}
  POST /download/{organize,sync,start-auto-sync}
  GET /download/tasks
  Admin: full CRUD on /admin/download/clients + /admin/download/aria2/stats

License:
  POST /license/{activate,heartbeat}
  GET /license/{status,heartbeat-status}
  Admin: /admin/license/{generate,list,:id/activations,:id/revoke,activation/:id/unbind}

Storage:
  GET /admin/storage/{status,:type}
  PUT /admin/storage/:type, POST /admin/storage/:type/test

Assistant (multi-turn AI):
  GET/POST /admin/assistant/sessions
  GET/DELETE /admin/assistant/session/:id
  POST /admin/assistant/{chat,execute}
  POST /admin/assistant/undo/:op_id
  GET /admin/assistant/history

== New React pages (4) ==
- AssistantChatPage (/assistant): full multi-turn chat UI with sessions
  sidebar, optimistic user-turn append, live AI response.
- DownloadClientsPage (/download-clients): typed CRUD form for
  qBittorrent / Aria2 / Transmission + per-row Test action.
- LicensePage (/license): generate keys, list activations, revoke,
  unbind individual devices.
- StorageConfigPage (/storage-config): tabbed Alist/WebDAV/S3 form
  with secret-aware redaction + connection probe.

== New API helpers (5) ==
- assistant, download_clients, license, permissions, storage_config

== Layout ==
- Sidebar gains 4 new admin links (AI 对话, 下载器, 外部存储, 许可证).

internal/handler/handler.go

@@ -171,6 +171,90 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 			authed.POST("/play-profiles", createPlayProfileHandler(svc))
 			authed.PUT("/play-profiles/:id", updatePlayProfileHandler(svc))
 			authed.DELETE("/play-profiles/:id", deletePlayProfileHandler(svc))
+
+			// ── Auth extras ──
+			authed.POST("/auth/refresh", refreshHandler(svc))
+			authed.POST("/auth/logout", logoutHandler(svc))
+			authed.GET("/auth/me", meHandler(svc))
+			authed.PATCH("/auth/profile", updateProfileHandler(svc))
+			authed.POST("/auth/change-password", changePasswordHandler(svc))
+			authed.GET("/auth/permissions", myPermissionsHandler(svc))
+
+			// ── Search aliases ──
+			authed.GET("/search", searchUnifiedHandler(svc))
+			authed.GET("/search/advanced", searchAdvancedHandler(svc))
+			authed.GET("/search/tmdb", searchTMDbHandler(svc))
+			authed.GET("/search/sites", searchSitesHandler(svc))
+
+			// ── System extras ──
+			authed.GET("/system/config", listSystemConfigHandler(svc))
+			authed.GET("/settings/schema", schemaHandler(svc))
+			authed.GET("/system/events/ticket", systemEventsTicketHandler(svc))
+
+			// ── Per-user stats ──
+			authed.GET("/stats/user/:id", statsUserHandler(svc))
+			authed.GET("/stats/top-users", statsTopUsersHandler(svc))
+			authed.POST("/stats/play", statsPlayHandler(svc))
+
+			// ── Sites extras ──
+			authed.GET("/sites/:id/resource", siteResourceHandler(svc))
+			authed.GET("/sites/:id/userdata", siteUserdataHandler(svc))
+
+			// ── Subscription extras ──
+			authed.PUT("/subscriptions/:id", updateSubscriptionHandler(svc))
+			authed.POST("/subscriptions/:id/search", searchSubscriptionHandler(svc))
+
+			// ── Playlist extras ──
+			authed.POST("/playlists/:id/reorder", reorderPlaylistHandler(svc))
+			authed.DELETE("/playlists/:id/items/by-id/:item_id", deletePlaylistItemByIDHandler(svc))
+
+			// ── DLNA per-renderer control ──
+			authed.POST("/dlna/:uuid/play", dlnaPlayHandler(svc))
+			authed.POST("/dlna/:uuid/pause", dlnaPauseHandler(svc))
+			authed.POST("/dlna/:uuid/stop", dlnaStopHandler(svc))
+			authed.GET("/dlna/:uuid/status", dlnaStatusHandler(svc))
+
+			// ── Media favourite alias surface ──
+			authed.GET("/favorites", listFavoritesAliasHandler(svc))
+			authed.POST("/media/:id/favorite", addMediaFavoriteHandler(svc))
+			authed.DELETE("/media/:id/favorite", removeMediaFavoriteHandler(svc))
+			authed.GET("/media/:id/favorite/status", getMediaFavoriteStatusHandler(svc))
+			authed.POST("/media/:id/ai-scrape", aiScrapeMediaHandler(svc))
+			authed.POST("/media/scrape/test", scrapeTestHandler(svc))
+			authed.POST("/media/organize", middleware.AdminRequired(), organizeBulkHandler(svc))
+
+			// ── Playback metadata + external player handoff ──
+			authed.GET("/playback/:id/info", playbackInfoHandler(svc))
+			authed.POST("/playback/:id/progress", playbackProgressHandler(svc))
+			authed.GET("/playback/:id/external-players", externalPlayersHandler(svc))
+			authed.GET("/playback/:id/external-url", externalURLHandler(svc))
+			authed.GET("/playback/transcode/:job_id/status", transcodeStatusHandler(svc))
+
+			// ── Download task ops + sync triggers ──
+			authed.POST("/download/:id/pause", downloadPauseHandler(svc))
+			authed.POST("/download/:id/resume", downloadResumeHandler(svc))
+			authed.POST("/download/:id/organize", middleware.AdminRequired(), downloadOrganizeOneHandler(svc))
+			authed.POST("/download/organize", middleware.AdminRequired(), downloadOrganizeAllHandler(svc))
+			authed.POST("/download/sync", middleware.AdminRequired(), downloadSyncHandler(svc))
+			authed.POST("/download/start-auto-sync", middleware.AdminRequired(), downloadAutoSyncHandler(svc))
+			authed.GET("/download/tasks", downloadTasksAliasHandler(svc))
+			authed.POST("/download/add", addDownloadHandler(svc))
+
+			// ── License (anyone authenticated can activate / heartbeat) ──
+			authed.POST("/license/activate", licenseActivateHandler(svc))
+			authed.POST("/license/heartbeat", licenseHeartbeatHandler(svc))
+			authed.GET("/license/status", licenseStatusHandler(svc))
+			authed.GET("/license/heartbeat-status", licenseStatusHandler(svc))
+
+			// ── Assistant (multi-turn AI chat) ──
+			authed.GET("/admin/assistant/sessions", listAssistantSessionsHandler(svc))
+			authed.POST("/admin/assistant/sessions", createAssistantSessionHandler(svc))
+			authed.GET("/admin/assistant/session/:id", getAssistantSessionHandler(svc))
+			authed.DELETE("/admin/assistant/session/:id", deleteAssistantSessionHandler(svc))
+			authed.POST("/admin/assistant/chat", assistantChatHandler(svc))
+			authed.POST("/admin/assistant/execute", assistantExecuteHandler(svc))
+			authed.POST("/admin/assistant/undo/:op_id", assistantUndoHandler(svc))
+			authed.GET("/admin/assistant/history", assistantHistoryHandler(svc))
 		}
 
 		// Admin-only endpoints.
@@ -184,6 +268,35 @@ func Register(r *gin.Engine, cfg *config.Config, log *zap.Logger, svc *service.C
 			admin.PUT("/settings", updateSettingHandler(svc))
 			admin.GET("/logs", recentLogsHandler(svc))
 
+			// Permissions admin.
+			admin.GET("/users/:id/permissions", getUserPermissionsHandler(svc))
+			admin.PUT("/users/:id/permissions", updateUserPermissionsHandler(svc))
+			admin.POST("/users/:id/permissions/reset", resetUserPermissionsHandler(svc))
+
+			// Storage configs (Alist / S3 / WebDAV).
+			admin.GET("/storage/status", listStorageConfigsHandler(svc))
+			admin.GET("/storage/:type", getStorageConfigHandler(svc))
+			admin.PUT("/storage/:type", saveStorageConfigHandler(svc))
+			admin.POST("/storage/:type/test", testStorageConfigHandler(svc))
+
+			// Download client CRUD.
+			admin.GET("/download/clients", listDownloadClientsHandler(svc))
+			admin.POST("/download/clients", createDownloadClientHandler(svc))
+			admin.PUT("/download/clients/:id", updateDownloadClientHandler(svc))
+			admin.DELETE("/download/clients/:id", deleteDownloadClientHandler(svc))
+			admin.POST("/download/clients/:id/test", testDownloadClientHandler(svc))
+			admin.GET("/download/aria2/stats", aria2StatsHandler(svc))
+
+			// License generation / revocation.
+			admin.POST("/license/generate", licenseGenerateHandler(svc))
+			admin.GET("/license/list", licenseListHandler(svc))
+			admin.GET("/license/:id/activations", licenseListActivationsHandler(svc))
+			admin.POST("/license/activation/:id/unbind", licenseUnbindHandler(svc))
+			admin.POST("/license/:id/revoke", licenseRevokeHandler(svc))
+
+			// System scheduler trigger alias.
+			admin.POST("/system/scheduler/:name/trigger", schedulerTriggerHandler(svc))
+
 			// Database backup.
 			admin.GET("/backups", listBackupsHandler(svc))
 			admin.POST("/backups", createBackupHandler(svc))