feat: complete Vue UI parity (full backend + frontend)

== New domain models (7) ==
- UserPermission: per-user feature toggles (13 booleans)
- StorageConfig: encrypted Alist/S3/WebDAV adapters
- LicenseKey + LicenseActivation: offline license issuance
- DownloadClient: multi-client downloader configs
- AssistantSession + AssistantMessage: multi-turn AI chat persistence

== New services (5) ==
- PermissionService: admin grants always-true; user defaults seeded
- StorageConfigService: AES-GCM encryption + per-type connection probe
- LicenseService: 24-char hyphenated key generation, activation/heartbeat
- DownloadClientService: qB/Aria2/Transmission CRUD + WebUI test
- AssistantService: chat history + execute/undo stubs (op_id tracking)

== Extended AIService.Chat ==
- Multi-turn LLM call with chat history; offline fallback reply

== New endpoints (60+) ==
Auth:
  POST /auth/refresh, /auth/logout, /auth/change-password
  PATCH /auth/profile
  GET /auth/permissions, /auth/me

Permissions admin:
  GET/PUT /admin/users/:id/permissions
  POST /admin/users/:id/permissions/reset

Search:
  GET /search, /search/advanced, /search/tmdb, /search/sites

System:
  GET /system/config, /settings/schema, /system/events/ticket
  POST /admin/system/scheduler/:name/trigger

Stats:
  GET /stats/user/:id, /stats/top-users
  POST /stats/play

Sites:
  GET /sites/:id/resource, /sites/:id/userdata

Subscriptions:
  PUT /subscriptions/:id, POST /subscriptions/:id/search

Playlists:
  POST /playlists/:id/reorder
  DELETE /playlists/:id/items/by-id/:item_id

DLNA per-renderer:
  POST /dlna/:uuid/{play,pause,stop}, GET /dlna/:uuid/status

Media:
  POST/DELETE /media/:id/favorite, GET /media/:id/favorite/status
  POST /media/:id/ai-scrape, /media/scrape/test, /media/organize
  GET /favorites (alias)

Playback:
  GET /playback/:id/info, /playback/:id/external-players, /playback/:id/external-url
  POST /playback/:id/progress
  GET /playback/transcode/:job_id/status

Downloads:
  POST /download/:id/{pause,resume,organize}
  POST /download/{organize,sync,start-auto-sync}
  GET /download/tasks
  Admin: full CRUD on /admin/download/clients + /admin/download/aria2/stats

License:
  POST /license/{activate,heartbeat}
  GET /license/{status,heartbeat-status}
  Admin: /admin/license/{generate,list,:id/activations,:id/revoke,activation/:id/unbind}

Storage:
  GET /admin/storage/{status,:type}
  PUT /admin/storage/:type, POST /admin/storage/:type/test

Assistant (multi-turn AI):
  GET/POST /admin/assistant/sessions
  GET/DELETE /admin/assistant/session/:id
  POST /admin/assistant/{chat,execute}
  POST /admin/assistant/undo/:op_id
  GET /admin/assistant/history

== New React pages (4) ==
- AssistantChatPage (/assistant): full multi-turn chat UI with sessions
  sidebar, optimistic user-turn append, live AI response.
- DownloadClientsPage (/download-clients): typed CRUD form for
  qBittorrent / Aria2 / Transmission + per-row Test action.
- LicensePage (/license): generate keys, list activations, revoke,
  unbind individual devices.
- StorageConfigPage (/storage-config): tabbed Alist/WebDAV/S3 form
  with secret-aware redaction + connection probe.

== New API helpers (5) ==
- assistant, download_clients, license, permissions, storage_config

== Layout ==
- Sidebar gains 4 new admin links (AI 对话, 下载器, 外部存储, 许可证).

internal/service/ai.go

@@ -164,3 +164,80 @@ func (a *AIService) complete(ctx context.Context, system, user string) (string,
 	}
 	return strings.TrimSpace(out.Choices[0].Message.Content), nil
 }
+
+
+// ChatTurn is one message in a multi-turn assistant transcript.
+type ChatTurn struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+// Chat sends an entire transcript to the LLM. When the AI is disabled
+// we return a deterministic offline reply so the assistant UI still
+// has something to render.
+func (a *AIService) Chat(ctx context.Context, history []ChatTurn) (string, error) {
+	if !a.Enabled() || len(history) == 0 {
+		return offlineReply(history), nil
+	}
+	// Build a chat/completions payload preserving the history order.
+	msgs := make([]map[string]string, 0, len(history)+1)
+	msgs = append(msgs, map[string]string{
+		"role": "system",
+		"content": "You are MediaStationGo's helpful media-library assistant. " +
+			"Respond concisely in the user's language. " +
+			"Never invent file paths or media that don't exist.",
+	})
+	for _, t := range history {
+		msgs = append(msgs, map[string]string{"role": t.Role, "content": t.Content})
+	}
+	payload := map[string]any{
+		"model":       a.cfg.AI.Model,
+		"temperature": 0.4,
+		"messages":    msgs,
+	}
+	body, _ := json.Marshal(payload)
+	endpoint := strings.TrimRight(a.cfg.AI.APIBase, "/") + "/chat/completions"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+a.cfg.AI.APIKey)
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		raw, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("ai %d: %s", resp.StatusCode, strings.TrimSpace(string(raw)))
+	}
+	type choice struct {
+		Message struct {
+			Content string `json:"content"`
+		} `json:"message"`
+	}
+	var out struct {
+		Choices []choice `json:"choices"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", err
+	}
+	if len(out.Choices) == 0 {
+		return "", errors.New("ai: empty completion")
+	}
+	return strings.TrimSpace(out.Choices[0].Message.Content), nil
+}
+
+// offlineReply returns a deterministic stand-in response so the UI's
+// chat view stays functional when the AI provider is not configured.
+func offlineReply(history []ChatTurn) string {
+	if len(history) == 0 {
+		return "Hi — AI provider is not configured. Set up OpenAI/DeepSeek in API Configs to chat with me."
+	}
+	last := history[len(history)-1].Content
+	if len(last) > 80 {
+		last = last[:80] + "…"
+	}
+	return "(offline) Heard: " + last + "\n请在 API 配置中接入 LLM 后重试。"
+}