feat(HEL-560): 数据中枢接管数据源/模型池/会员，注册改一次性邀请码

主站
- 新增 m0006 invite_codes 迁移；注册强制邀请码（首个管理员除外），消码与建号
  同一事务，并发提交只有一个能成功
- 新增 /api/hub-admin/* 服务端点（共享 HUB_ADMIN_TOKEN，先于鉴权校验），供数据
  中枢桥接读写会话/密码/模型池/会员/邀请码，并提供供应商模型列表拉取
- 前端：注册表单加邀请码（桌面 login、index.html、移动端）；「系统管理」改为
  「数据中枢」入口指向 8766，原模型池与会员管理分区移除，仅留「行情管理」；
  随之清理陈旧 CSS

数据中枢
- 取消独立账号：删除 hub_admin/hub_sessions 与登录、改密、锁定逻辑，改为校验
  主站 xiaobai_session，仅管理员可进，CSRF 由会话派生，危险操作二次确认走主站
- 控制台新增数据源凭证可编辑区（原有内容一项不删）、供应商制模型池（自动拉取
  /models，失败退回卡内手动录入）、会员管理与邀请码页
- 日夜双主题：颜色收敛为同名 token 换值，SVG 改用 inline style 以吃到变量

自测
- 主站 verify_baseline 通过（498 项）；数据中枢 235 项通过
- tools/verify_datahub_console.py 端到端跑通两服务真实对话；
  tools/verify_datahub_console_ui.py 浏览器跑通门禁/凭证/模型池/会员/主题/1030 窄屏

Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/datahub/admin_api.py

@@ -16,12 +16,23 @@ from datahub.timeutil import isoformat, now_shanghai, session_phase, yyyymmdd
 
 
 class AdminAPI:
-    def __init__(self, db: HubDB, pipeline: Pipeline, scheduler: Scheduler, auth: AuthService, ifind: Any = None) -> None:
+    def __init__(
+        self,
+        db: HubDB,
+        pipeline: Pipeline,
+        scheduler: Scheduler,
+        auth: AuthService,
+        ifind: Any = None,
+        site_auth: Any = None,
+    ) -> None:
         self.db = db
         self.pipeline = pipeline
         self.scheduler = scheduler
         self.auth = auth
         self.ifind = ifind
+        # HEL-560: dangerous operations confirm against the review site account
+        # that is driving the console, not against a console-local password.
+        self.site_auth = site_auth
 
     def overview(self) -> dict[str, Any]:
         today = yyyymmdd(now_shanghai())
@@ -211,18 +222,34 @@ class AdminAPI:
     def audit(self) -> dict[str, Any]:
         return {"items": self.db.fetchall("SELECT * FROM audit_log ORDER BY id DESC LIMIT 200")}
 
-    def rollback(self, dataset: str, trade_date: str, password: str, confirm: str, actor: str) -> dict[str, Any]:
-        self._dangerous(password, confirm, f"{dataset}:{trade_date}")
+    def rollback(
+        self,
+        dataset: str,
+        trade_date: str,
+        password: str,
+        confirm: str,
+        actor: str,
+        actor_id: int = 0,
+    ) -> dict[str, Any]:
+        self._dangerous(password, confirm, f"{dataset}:{trade_date}", actor_id)
         result = self.pipeline.rollback(dataset, trade_date, actor=actor)
         return result
 
-    def backfill(self, dataset: str, trade_date: str, password: str, confirm: str, actor: str) -> dict[str, Any]:
+    def backfill(
+        self,
+        dataset: str,
+        trade_date: str,
+        password: str,
+        confirm: str,
+        actor: str,
+        actor_id: int = 0,
+    ) -> dict[str, Any]:
         day = yyyymmdd(trade_date or now_shanghai())
         if dataset == "history":
-            self._dangerous(password, confirm, "history:full")
+            self._dangerous(password, confirm, "history:full", actor_id)
             result = self.pipeline.backfill_history(day)
         else:
-            self._dangerous(password, confirm, f"{dataset}:{day}")
+            self._dangerous(password, confirm, f"{dataset}:{day}", actor_id)
             if dataset == "reference":
                 result = self.pipeline.ingest_reference(day)
             elif dataset in OFFICIAL_DATASETS or dataset == STOCKS_DATASET:
@@ -244,12 +271,18 @@ class AdminAPI:
         self.pipeline.audit(actor, "backfill", f"{dataset}:{day}", json.dumps({"ok": True}))
         return result
 
-    def _dangerous(self, password: str, confirm: str, expected: str) -> None:
-        if not self.auth.confirm_password(password):
+    def _dangerous(self, password: str, confirm: str, expected: str, actor_id: int = 0) -> None:
+        if not self._confirm_password(actor_id, password):
             raise ApiError("UNAUTHORIZED", "二次确认密码错误")
         if confirm.strip() != expected:
             raise ApiError("INVALID_ARGUMENT", f"确认词必须为 {expected}")
 
+    def _confirm_password(self, actor_id: int, password: str) -> bool:
+        """Second factor for destructive ops: the operator's review-site password."""
+        if self.site_auth is None:
+            raise ApiError("UNAVAILABLE", "主站桥接未配置，无法校验管理员口令")
+        return bool(self.site_auth.confirm_password(actor_id, password))
+
 
 def _public_calls(rows: list[dict[str, Any]]) -> list[dict[str, Any]]:
     out = []