feat: complete Vue UI parity (full backend + frontend)

== New domain models (7) ==
- UserPermission: per-user feature toggles (13 booleans)
- StorageConfig: encrypted Alist/S3/WebDAV adapters
- LicenseKey + LicenseActivation: offline license issuance
- DownloadClient: multi-client downloader configs
- AssistantSession + AssistantMessage: multi-turn AI chat persistence

== New services (5) ==
- PermissionService: admin grants always-true; user defaults seeded
- StorageConfigService: AES-GCM encryption + per-type connection probe
- LicenseService: 24-char hyphenated key generation, activation/heartbeat
- DownloadClientService: qB/Aria2/Transmission CRUD + WebUI test
- AssistantService: chat history + execute/undo stubs (op_id tracking)

== Extended AIService.Chat ==
- Multi-turn LLM call with chat history; offline fallback reply

== New endpoints (60+) ==
Auth:
  POST /auth/refresh, /auth/logout, /auth/change-password
  PATCH /auth/profile
  GET /auth/permissions, /auth/me

Permissions admin:
  GET/PUT /admin/users/:id/permissions
  POST /admin/users/:id/permissions/reset

Search:
  GET /search, /search/advanced, /search/tmdb, /search/sites

System:
  GET /system/config, /settings/schema, /system/events/ticket
  POST /admin/system/scheduler/:name/trigger

Stats:
  GET /stats/user/:id, /stats/top-users
  POST /stats/play

Sites:
  GET /sites/:id/resource, /sites/:id/userdata

Subscriptions:
  PUT /subscriptions/:id, POST /subscriptions/:id/search

Playlists:
  POST /playlists/:id/reorder
  DELETE /playlists/:id/items/by-id/:item_id

DLNA per-renderer:
  POST /dlna/:uuid/{play,pause,stop}, GET /dlna/:uuid/status

Media:
  POST/DELETE /media/:id/favorite, GET /media/:id/favorite/status
  POST /media/:id/ai-scrape, /media/scrape/test, /media/organize
  GET /favorites (alias)

Playback:
  GET /playback/:id/info, /playback/:id/external-players, /playback/:id/external-url
  POST /playback/:id/progress
  GET /playback/transcode/:job_id/status

Downloads:
  POST /download/:id/{pause,resume,organize}
  POST /download/{organize,sync,start-auto-sync}
  GET /download/tasks
  Admin: full CRUD on /admin/download/clients + /admin/download/aria2/stats

License:
  POST /license/{activate,heartbeat}
  GET /license/{status,heartbeat-status}
  Admin: /admin/license/{generate,list,:id/activations,:id/revoke,activation/:id/unbind}

Storage:
  GET /admin/storage/{status,:type}
  PUT /admin/storage/:type, POST /admin/storage/:type/test

Assistant (multi-turn AI):
  GET/POST /admin/assistant/sessions
  GET/DELETE /admin/assistant/session/:id
  POST /admin/assistant/{chat,execute}
  POST /admin/assistant/undo/:op_id
  GET /admin/assistant/history

== New React pages (4) ==
- AssistantChatPage (/assistant): full multi-turn chat UI with sessions
  sidebar, optimistic user-turn append, live AI response.
- DownloadClientsPage (/download-clients): typed CRUD form for
  qBittorrent / Aria2 / Transmission + per-row Test action.
- LicensePage (/license): generate keys, list activations, revoke,
  unbind individual devices.
- StorageConfigPage (/storage-config): tabbed Alist/WebDAV/S3 form
  with secret-aware redaction + connection probe.

== New API helpers (5) ==
- assistant, download_clients, license, permissions, storage_config

== Layout ==
- Sidebar gains 4 new admin links (AI 对话, 下载器, 外部存储, 许可证).

internal/model/model.go

@@ -275,6 +275,104 @@ type PlayProfile struct {
 	LastActiveAt          *time.Time `json:"last_active_at,omitempty"`
 }
 
+// UserPermission stores per-user feature toggles for the React UI's
+// menu visibility + route guards. The original Python project surfaces
+// 11 boolean flags; we mirror the same set so the existing frontend
+// can swap to the Go API without code changes.
+type UserPermission struct {
+	UserID                 string    `gorm:"primaryKey;size:36" json:"user_id"`
+	CanPlayMedia           bool      `gorm:"default:true" json:"can_play_media"`
+	CanFavorite            bool      `gorm:"default:true" json:"can_favorite"`
+	CanViewHistory         bool      `gorm:"default:true" json:"can_view_history"`
+	CanViewDashboard       bool      `gorm:"default:true" json:"can_view_dashboard"`
+	CanViewDiscover        bool      `gorm:"default:true" json:"can_view_discover"`
+	CanManageDownloads     bool      `gorm:"default:false" json:"can_manage_downloads"`
+	CanManageSubscriptions bool      `gorm:"default:false" json:"can_manage_subscriptions"`
+	CanManageSites         bool      `gorm:"default:false" json:"can_manage_sites"`
+	CanManageFiles         bool      `gorm:"default:false" json:"can_manage_files"`
+	CanManageSTRM          bool      `gorm:"default:false" json:"can_manage_strm"`
+	CanCast                bool      `gorm:"default:true" json:"can_cast"`
+	CanUseAIAssistant      bool      `gorm:"default:false" json:"can_use_ai_assistant"`
+	CanAccessSettings      bool      `gorm:"default:false" json:"can_access_settings"`
+	UpdatedAt              time.Time `json:"updated_at"`
+}
+
+// StorageConfig holds the connection settings for one external storage
+// backend (Alist / S3 / WebDAV). Type column makes the row poly-typed
+// — Config is a JSON blob whose shape is determined by Type.
+//
+//	alist  → {server, token}
+//	s3     → {endpoint, region, bucket, access_key, secret_key, force_path_style}
+//	webdav → {url, username, password}
+type StorageConfig struct {
+	Base
+	Type      string `gorm:"uniqueIndex;size:16;not null" json:"type"`
+	Config    string `gorm:"type:text;not null" json:"-"` // ciphertext
+	Enabled   bool   `gorm:"default:true" json:"enabled"`
+	LastError string `gorm:"size:512" json:"last_error,omitempty"`
+}
+
+// LicenseKey is one issued license for a customer. Activations live in
+// a child table so a single key can bind to multiple devices when its
+// MaxActivations > 1.
+type LicenseKey struct {
+	Base
+	Key            string     `gorm:"uniqueIndex;size:64;not null" json:"key"`
+	Customer       string     `gorm:"size:128" json:"customer,omitempty"`
+	Plan           string     `gorm:"size:32;default:basic" json:"plan"`
+	MaxActivations int        `gorm:"default:1" json:"max_activations"`
+	IssuedAt       time.Time  `json:"issued_at"`
+	ExpiresAt      *time.Time `json:"expires_at,omitempty"`
+	Revoked        bool       `gorm:"default:false" json:"revoked"`
+	Notes          string     `gorm:"type:text" json:"notes,omitempty"`
+}
+
+// LicenseActivation is one (key, device) binding.
+type LicenseActivation struct {
+	Base
+	KeyID      string     `gorm:"index;size:36;not null" json:"key_id"`
+	DeviceID   string     `gorm:"size:128;not null" json:"device_id"`
+	DeviceName string     `gorm:"size:128" json:"device_name,omitempty"`
+	IP         string     `gorm:"size:64" json:"ip,omitempty"`
+	UnboundAt  *time.Time `json:"unbound_at,omitempty"`
+	HeartbeatAt *time.Time `json:"heartbeat_at,omitempty"`
+}
+
+// DownloadClient is one configured downloader (qBittorrent / Aria2 /
+// Transmission). We keep the password column out of JSON so list calls
+// don't leak secrets to the React UI.
+type DownloadClient struct {
+	Base
+	Name     string `gorm:"size:128;not null" json:"name"`
+	Type     string `gorm:"size:16;not null" json:"type"` // qbittorrent / transmission / aria2
+	URL      string `gorm:"size:512;not null" json:"url"`
+	Username string `gorm:"size:128" json:"username,omitempty"`
+	Password string `gorm:"size:512" json:"-"`
+	SavePath string `gorm:"size:1024" json:"save_path,omitempty"`
+	IsDefault bool  `gorm:"default:false" json:"is_default"`
+	Enabled  bool   `gorm:"default:true" json:"enabled"`
+}
+
+// AssistantSession groups a multi-turn chat with the AI assistant.
+type AssistantSession struct {
+	Base
+	UserID string `gorm:"index;size:36;not null" json:"user_id"`
+	Title  string `gorm:"size:255" json:"title,omitempty"`
+}
+
+// AssistantMessage is one entry in an AssistantSession transcript.
+//
+// Role is "user" | "assistant" | "system".  The optional OperationID
+// links a message to an action the assistant proposed (so the UI can
+// offer Undo).
+type AssistantMessage struct {
+	Base
+	SessionID   string `gorm:"index;size:36;not null" json:"session_id"`
+	Role        string `gorm:"size:16;not null" json:"role"`
+	Content     string `gorm:"type:text;not null" json:"content"`
+	OperationID string `gorm:"size:36" json:"operation_id,omitempty"`
+}
+
 // AllModels returns the slice consumed by gorm.AutoMigrate.
 func AllModels() []interface{} {
 	return []interface{}{
@@ -294,5 +392,12 @@ func AllModels() []interface{} {
 		&APIConfig{},
 		&NotifyChannel{},
 		&PlayProfile{},
+		&UserPermission{},
+		&StorageConfig{},
+		&LicenseKey{},
+		&LicenseActivation{},
+		&DownloadClient{},
+		&AssistantSession{},
+		&AssistantMessage{},
 	}
 }