feat(HEL-560): 数据中枢接管数据源/模型池/会员，注册改一次性邀请码

主站
- 新增 m0006 invite_codes 迁移；注册强制邀请码（首个管理员除外），消码与建号
  同一事务，并发提交只有一个能成功
- 新增 /api/hub-admin/* 服务端点（共享 HUB_ADMIN_TOKEN，先于鉴权校验），供数据
  中枢桥接读写会话/密码/模型池/会员/邀请码，并提供供应商模型列表拉取
- 前端：注册表单加邀请码（桌面 login、index.html、移动端）；「系统管理」改为
  「数据中枢」入口指向 8766，原模型池与会员管理分区移除，仅留「行情管理」；
  随之清理陈旧 CSS

数据中枢
- 取消独立账号：删除 hub_admin/hub_sessions 与登录、改密、锁定逻辑，改为校验
  主站 xiaobai_session，仅管理员可进，CSRF 由会话派生，危险操作二次确认走主站
- 控制台新增数据源凭证可编辑区（原有内容一项不删）、供应商制模型池（自动拉取
  /models，失败退回卡内手动录入）、会员管理与邀请码页
- 日夜双主题：颜色收敛为同名 token 换值，SVG 改用 inline style 以吃到变量

自测
- 主站 verify_baseline 通过（498 项）；数据中枢 235 项通过
- tools/verify_datahub_console.py 端到端跑通两服务真实对话；
  tools/verify_datahub_console_ui.py 浏览器跑通门禁/凭证/模型池/会员/主题/1030 窄屏

Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/fixtures.py

@@ -113,3 +113,51 @@ def fake_transport(api_name: str, params: dict, fields: str):
         if limit_type:
             rows = [row for row in rows if str(row.get("limit_type") or "") == limit_type]
     return rows
+
+
+class StubSiteAuth:
+    """Stand-in for the review-site session bridge.
+
+    The console verifies operators against the review site over HTTP, which
+    tests must not depend on. This stub answers from a fixed session -> user
+    map and keeps the same stateless-HMAC CSRF contract as the real service, so
+    tests exercise the console's own gate rather than the network hop.
+    """
+
+    SESSION = "site-session-token"
+    ADMIN = {"id": 1, "username": "admin", "role": "admin", "is_admin": True}
+    MEMBER = {"id": 2, "username": "member", "role": "user", "is_admin": False}
+
+    def __init__(self, password: str = "AdminPass1", secret: str = "stub-secret") -> None:
+        self.password = password
+        self.secret = secret
+        self.sessions = {self.SESSION: dict(self.ADMIN)}
+        self.logged_out: list[str] = []
+
+    def add_session(self, token: str, user: dict) -> None:
+        self.sessions[token] = dict(user)
+
+    def verify(self, session_token: str):
+        return self.sessions.get(session_token)
+
+    def csrf_token(self, session_token: str) -> str:
+        import hashlib
+        import hmac
+
+        digest = hashlib.sha256(session_token.encode("utf-8")).digest()
+        return hmac.new(self.secret.encode("utf-8"), digest, hashlib.sha256).hexdigest()
+
+    def check_csrf(self, session_token: str, supplied: str) -> bool:
+        import hmac
+
+        return bool(supplied) and hmac.compare_digest(self.csrf_token(session_token), supplied)
+
+    def logout(self, session_token: str) -> None:
+        self.logged_out.append(session_token)
+        self.sessions.pop(session_token, None)
+
+    def confirm_password(self, user_id: int, password: str) -> bool:
+        return bool(password) and password == self.password
+
+    def invalidate(self, session_token: str) -> None:
+        pass