feat: 实现 JWT 认证、API Key 管理及安全增强

[BegoniaHe]

feat: 实现 JWT 认证、API Key 管理及安全增强

安全性改进

• 实现 JWT 认证系统（单用户模式，支持 token 刷新）
• 新增 API Key 集中管理模块（Fernet 加密存储）
• 修复命令注入漏洞（移除 subprocess shell=True）
• 限制 CORS 配置为白名单模式（默认 localhost）
• 新增 4 个认证 API：登录、刷新、修改密码、获取用户
• 新增 5 个 API Key 管理 API：增删改查

代码质量提升

• 配置代码格式化工具（Black, Flake8, isort, Prettier）
• 提取 100+ 配置常量到 core/constants.py
• 对所有 Python 文件执行格式化（109 个文件）
• 配置 pre-commit hooks 自动检查

基础设施

• 新增 start.sh/stop.sh 启动脚本（uv + nvm）
• 创建 .env.example 环境变量模板
• 生成依赖锁定文件（requirements.lock）
• 新增详细文档（AUTH_GUIDE.md, UPDATE_LOG.md）

问题修复

• 修复前端 Vue 模板语法错误（CustomScrollbar.vue）
• 禁用 vite-plugin-vue-devtools（兼容性问题）
• 更新前端依赖并生成 package-lock.json

依赖更新

• PyJWT>=2.8.0（JWT 认证）
• cryptography>=41.0.0（加密存储）
• black>=23.12.0, flake8>=7.0.0, isort>=5.13.0（代码格式化）
• pre-commit>=3.6.0（Git hooks）

文档

• 创建快速开始指南（AUTH_GUIDE.md）
• 生成详细更新日志（UPDATE_LOG.md）
• 更新 .gitignore 忽略敏感文件

影响范围：核心框架、API 模块、前端项目、配置文件
Breaking Changes: 需要配置环境变量（JWT_SECRET_KEY, API_KEY_ENCRYPTION_KEY）

[Copilot]

Pull request overview

This PR implements a comprehensive security enhancement and code quality improvement initiative. The changes introduce JWT authentication with token refresh support, centralized API key management with Fernet encryption, and fix critical security vulnerabilities including command injection. Additionally, it establishes code formatting standards across the entire Python codebase and improves project infrastructure with startup scripts and detailed documentation.

Key Changes:

• Implemented JWT authentication system with single-user mode and token refresh capability
• Added centralized API key management module with encrypted storage
• Fixed command injection vulnerability by removing shell=True from subprocess calls
• Established code formatting standards (Black, Flake8, isort, Prettier) and formatted 109 Python files
• Created startup/stop scripts and comprehensive documentation

Reviewed changes

Copilot reviewed 78 out of 267 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
core/api_client.py	Applied code formatting (import sorting, line breaks)
core/__init__.py	Added new auth and API key manager exports
backend_projects/SmartTavern/plugins/postprocess_orchestrator/hooks.py	Applied comprehensive formatting to hook implementation
backend_projects/SmartTavern/plugins/context-variables/hooks.py	Formatted plugin hooks and fixed trailing whitespace
backend_projects/SmartTavern/data/conversations/测试对话/*	Added new test conversation data files
backend_projects/ProjectManager/start_server.py	Applied formatting to project startup script
api/workflow/image_binding/image_binding.py	Formatted API definitions with proper line breaks
api/workflow/SmartTavern/variables_update/*.py	Applied formatting to variable update modules
api/workflow/SmartTavern/prompt_router/*.py	Formatted prompt routing implementation
api/workflow/SmartTavern/prompt_raw/*.py	Applied formatting to RAW prompt assembly
api/workflow/SmartTavern/prompt_postprocess/*.py	Formatted post-processing workflow
api/workflow/SmartTavern/chat_completion/*.py	Applied extensive formatting to chat completion logic
api/plugins/SmartTavern/postprocess_registry/postprocess_registry.py	Formatted registry implementation
api/plugins/SmartTavern/plugin_loader.py	Applied formatting and fixed import order
api/plugins/SmartTavern/hook_manager.py	Formatted hook manager with improved readability
api/plugins/SmartTavern/context_variables/*.py	Applied formatting to context variables plugin
api/plugins/SmartTavern/__init__.py	Cleaned up imports and formatting
api/modules/web_server/*.py	Formatted web server implementation
api/modules/project_manager/*.py	Critical security fix: Removed shell=True to prevent command injection
api/modules/llm_api/*.py	Applied formatting to LLM API module
api/modules/auth/*.py	Added new authentication API endpoints
api/modules/api_keys/__init__.py	Added new API key management module
api/modules/SmartTavern/*	Applied formatting across SmartTavern modules

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.