feat: complete Vue UI parity (full backend + frontend)

== New domain models (7) ==
- UserPermission: per-user feature toggles (13 booleans)
- StorageConfig: encrypted Alist/S3/WebDAV adapters
- LicenseKey + LicenseActivation: offline license issuance
- DownloadClient: multi-client downloader configs
- AssistantSession + AssistantMessage: multi-turn AI chat persistence

== New services (5) ==
- PermissionService: admin grants always-true; user defaults seeded
- StorageConfigService: AES-GCM encryption + per-type connection probe
- LicenseService: 24-char hyphenated key generation, activation/heartbeat
- DownloadClientService: qB/Aria2/Transmission CRUD + WebUI test
- AssistantService: chat history + execute/undo stubs (op_id tracking)

== Extended AIService.Chat ==
- Multi-turn LLM call with chat history; offline fallback reply

== New endpoints (60+) ==
Auth:
  POST /auth/refresh, /auth/logout, /auth/change-password
  PATCH /auth/profile
  GET /auth/permissions, /auth/me

Permissions admin:
  GET/PUT /admin/users/:id/permissions
  POST /admin/users/:id/permissions/reset

Search:
  GET /search, /search/advanced, /search/tmdb, /search/sites

System:
  GET /system/config, /settings/schema, /system/events/ticket
  POST /admin/system/scheduler/:name/trigger

Stats:
  GET /stats/user/:id, /stats/top-users
  POST /stats/play

Sites:
  GET /sites/:id/resource, /sites/:id/userdata

Subscriptions:
  PUT /subscriptions/:id, POST /subscriptions/:id/search

Playlists:
  POST /playlists/:id/reorder
  DELETE /playlists/:id/items/by-id/:item_id

DLNA per-renderer:
  POST /dlna/:uuid/{play,pause,stop}, GET /dlna/:uuid/status

Media:
  POST/DELETE /media/:id/favorite, GET /media/:id/favorite/status
  POST /media/:id/ai-scrape, /media/scrape/test, /media/organize
  GET /favorites (alias)

Playback:
  GET /playback/:id/info, /playback/:id/external-players, /playback/:id/external-url
  POST /playback/:id/progress
  GET /playback/transcode/:job_id/status

Downloads:
  POST /download/:id/{pause,resume,organize}
  POST /download/{organize,sync,start-auto-sync}
  GET /download/tasks
  Admin: full CRUD on /admin/download/clients + /admin/download/aria2/stats

License:
  POST /license/{activate,heartbeat}
  GET /license/{status,heartbeat-status}
  Admin: /admin/license/{generate,list,:id/activations,:id/revoke,activation/:id/unbind}

Storage:
  GET /admin/storage/{status,:type}
  PUT /admin/storage/:type, POST /admin/storage/:type/test

Assistant (multi-turn AI):
  GET/POST /admin/assistant/sessions
  GET/DELETE /admin/assistant/session/:id
  POST /admin/assistant/{chat,execute}
  POST /admin/assistant/undo/:op_id
  GET /admin/assistant/history

== New React pages (4) ==
- AssistantChatPage (/assistant): full multi-turn chat UI with sessions
  sidebar, optimistic user-turn append, live AI response.
- DownloadClientsPage (/download-clients): typed CRUD form for
  qBittorrent / Aria2 / Transmission + per-row Test action.
- LicensePage (/license): generate keys, list activations, revoke,
  unbind individual devices.
- StorageConfigPage (/storage-config): tabbed Alist/WebDAV/S3 form
  with secret-aware redaction + connection probe.

== New API helpers (5) ==
- assistant, download_clients, license, permissions, storage_config

== Layout ==
- Sidebar gains 4 new admin links (AI 对话, 下载器, 外部存储, 许可证).

web/src/api/assistant.ts

@@ -0,0 +1,65 @@
+import { api } from './client'
+
+export interface AssistantSession {
+  id: string
+  user_id: string
+  title: string
+  created_at: string
+  updated_at: string
+}
+
+export interface AssistantMessage {
+  id: string
+  session_id: string
+  role: 'user' | 'assistant' | 'system'
+  content: string
+  operation_id?: string
+  created_at: string
+}
+
+export interface SessionView {
+  session: AssistantSession
+  messages: AssistantMessage[]
+}
+
+export const assistantAPI = {
+  listSessions: () =>
+    api.get<AssistantSession[]>('/admin/assistant/sessions').then((r) => r.data),
+
+  createSession: (title?: string) =>
+    api
+      .post<AssistantSession>('/admin/assistant/sessions', { title })
+      .then((r) => r.data),
+
+  getSession: (id: string) =>
+    api.get<SessionView>(`/admin/assistant/session/${id}`).then((r) => r.data),
+
+  deleteSession: (id: string) =>
+    api.delete(`/admin/assistant/session/${id}`).then((r) => r.data),
+
+  chat: (sessionID: string, message: string) =>
+    api
+      .post<SessionView>('/admin/assistant/chat', {
+        session_id: sessionID,
+        message,
+      })
+      .then((r) => r.data),
+
+  execute: (sessionID: string, action: Record<string, unknown>) =>
+    api
+      .post<{ op_id: string }>('/admin/assistant/execute', {
+        session_id: sessionID,
+        action,
+      })
+      .then((r) => r.data),
+
+  undo: (opID: string) =>
+    api.post(`/admin/assistant/undo/${opID}`).then((r) => r.data),
+
+  history: () =>
+    api
+      .get<{ items: { op_id: string; session: string; created_at: string; content: string }[] }>(
+        '/admin/assistant/history',
+      )
+      .then((r) => r.data.items),
+}

web/src/api/download_clients.ts

@@ -0,0 +1,53 @@
+import { api } from './client'
+
+export type DownloadClientType = 'qbittorrent' | 'aria2' | 'transmission'
+
+export interface DownloadClient {
+  id: string
+  name: string
+  type: DownloadClientType
+  url: string
+  username?: string
+  save_path?: string
+  is_default: boolean
+  enabled: boolean
+  created_at: string
+  updated_at: string
+}
+
+export interface DownloadClientInput {
+  name: string
+  type: DownloadClientType
+  url: string
+  username?: string
+  password?: string
+  save_path?: string
+  is_default: boolean
+  enabled: boolean
+}
+
+export const downloadClientsAPI = {
+  list: () =>
+    api.get<DownloadClient[]>('/admin/download/clients').then((r) => r.data),
+
+  create: (input: DownloadClientInput) =>
+    api.post<DownloadClient>('/admin/download/clients', input).then((r) => r.data),
+
+  update: (id: string, input: DownloadClientInput) =>
+    api
+      .put<DownloadClient>(`/admin/download/clients/${id}`, input)
+      .then((r) => r.data),
+
+  remove: (id: string) =>
+    api.delete(`/admin/download/clients/${id}`).then((r) => r.data),
+
+  test: (id: string) =>
+    api
+      .post<{ ok: boolean; error?: string }>(`/admin/download/clients/${id}/test`)
+      .then((r) => r.data),
+
+  aria2Stats: (clientID: string) =>
+    api
+      .get('/admin/download/aria2/stats', { params: { client_id: clientID } })
+      .then((r) => r.data),
+}

web/src/api/license.ts

@@ -0,0 +1,71 @@
+import { api } from './client'
+
+// LicenseKey + LicenseActivation mirror the Go model structs.
+export interface LicenseKey {
+  id: string
+  key: string
+  customer?: string
+  plan: string
+  max_activations: number
+  issued_at: string
+  expires_at?: string | null
+  revoked: boolean
+  notes?: string
+  created_at: string
+  updated_at: string
+}
+
+export interface LicenseActivation {
+  id: string
+  key_id: string
+  device_id: string
+  device_name?: string
+  ip?: string
+  unbound_at?: string | null
+  heartbeat_at?: string | null
+  created_at: string
+}
+
+export interface GenerateKeyInput {
+  customer?: string
+  plan?: string
+  max_activations?: number
+  expires_at?: string // RFC3339; "" or omit for perpetual
+  notes?: string
+}
+
+export const licenseAPI = {
+  generate: (input: GenerateKeyInput) =>
+    api.post<LicenseKey>('/admin/license/generate', input).then((r) => r.data),
+
+  list: () => api.get<LicenseKey[]>('/admin/license/list').then((r) => r.data),
+
+  listActivations: (keyID: string) =>
+    api
+      .get<LicenseActivation[]>(`/admin/license/${keyID}/activations`)
+      .then((r) => r.data),
+
+  revoke: (keyID: string) =>
+    api.post(`/admin/license/${keyID}/revoke`).then((r) => r.data),
+
+  unbind: (activationID: string) =>
+    api.post(`/admin/license/activation/${activationID}/unbind`).then((r) => r.data),
+
+  // Self-service
+  activate: (key: string, deviceID: string, deviceName?: string) =>
+    api
+      .post<LicenseActivation>('/license/activate', {
+        key,
+        device_id: deviceID,
+        device_name: deviceName,
+      })
+      .then((r) => r.data),
+
+  status: (keyID: string) =>
+    api
+      .get<{ key: LicenseKey; active_activations: number; valid: boolean }>(
+        '/license/status',
+        { params: { key_id: keyID } },
+      )
+      .then((r) => r.data),
+}

web/src/api/permissions.ts

@@ -0,0 +1,38 @@
+import { api } from './client'
+
+export interface UserPermission {
+  user_id: string
+  can_play_media: boolean
+  can_favorite: boolean
+  can_view_history: boolean
+  can_view_dashboard: boolean
+  can_view_discover: boolean
+  can_manage_downloads: boolean
+  can_manage_subscriptions: boolean
+  can_manage_sites: boolean
+  can_manage_files: boolean
+  can_manage_strm: boolean
+  can_cast: boolean
+  can_use_ai_assistant: boolean
+  can_access_settings: boolean
+  updated_at: string
+}
+
+export const permissionsAPI = {
+  // Caller's effective permissions; admins always get the all-true set.
+  mine: () => api.get<UserPermission>('/auth/permissions').then((r) => r.data),
+
+  // Admin endpoints
+  get: (userID: string) =>
+    api.get<UserPermission>(`/admin/users/${userID}/permissions`).then((r) => r.data),
+
+  save: (userID: string, p: UserPermission) =>
+    api
+      .put<UserPermission>(`/admin/users/${userID}/permissions`, p)
+      .then((r) => r.data),
+
+  reset: (userID: string) =>
+    api
+      .post<UserPermission>(`/admin/users/${userID}/permissions/reset`)
+      .then((r) => r.data),
+}

web/src/api/storage_config.ts

@@ -0,0 +1,36 @@
+import { api } from './client'
+
+export type StorageType = 'alist' | 's3' | 'webdav'
+
+export interface StorageConfig {
+  id: string
+  type: StorageType
+  config: Record<string, string>
+  enabled: boolean
+  last_error?: string
+  created_at: string
+  updated_at: string
+}
+
+export const storageAPI = {
+  status: () =>
+    api
+      .get<{ items: StorageConfig[] }>('/admin/storage/status')
+      .then((r) => r.data.items),
+
+  get: (type: StorageType) =>
+    api.get<StorageConfig>(`/admin/storage/${type}`).then((r) => r.data),
+
+  save: (type: StorageType, config: Record<string, string>, enabled = true) =>
+    api
+      .put<StorageConfig>(`/admin/storage/${type}`, { type, config, enabled })
+      .then((r) => r.data),
+
+  test: (type: StorageType, config: Record<string, string>) =>
+    api
+      .post<{ ok: boolean; error?: string }>(`/admin/storage/${type}/test`, {
+        type,
+        config,
+      })
+      .then((r) => r.data),
+}