feat(HEL-560): 数据中枢接管数据源/模型池/会员，注册改一次性邀请码

主站
- 新增 m0006 invite_codes 迁移；注册强制邀请码（首个管理员除外），消码与建号
  同一事务，并发提交只有一个能成功
- 新增 /api/hub-admin/* 服务端点（共享 HUB_ADMIN_TOKEN，先于鉴权校验），供数据
  中枢桥接读写会话/密码/模型池/会员/邀请码，并提供供应商模型列表拉取
- 前端：注册表单加邀请码（桌面 login、index.html、移动端）；「系统管理」改为
  「数据中枢」入口指向 8766，原模型池与会员管理分区移除，仅留「行情管理」；
  随之清理陈旧 CSS

数据中枢
- 取消独立账号：删除 hub_admin/hub_sessions 与登录、改密、锁定逻辑，改为校验
  主站 xiaobai_session，仅管理员可进，CSRF 由会话派生，危险操作二次确认走主站
- 控制台新增数据源凭证可编辑区（原有内容一项不删）、供应商制模型池（自动拉取
  /models，失败退回卡内手动录入）、会员管理与邀请码页
- 日夜双主题：颜色收敛为同名 token 换值，SVG 改用 inline style 以吃到变量

自测
- 主站 verify_baseline 通过（498 项）；数据中枢 235 项通过
- tools/verify_datahub_console.py 端到端跑通两服务真实对话；
  tools/verify_datahub_console_ui.py 浏览器跑通门禁/凭证/模型池/会员/主题/1030 窄屏

Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/test_admin_observability_api.py

@@ -13,7 +13,7 @@ from datahub.crypto import SecretVault
 from datahub.httpapp import make_handler
 from datahub.hub import Hub
 from datahub.settings import Settings
-from tests.fixtures import TRADE_DATE, fake_transport
+from tests.fixtures import TRADE_DATE, StubSiteAuth, fake_transport
 
 
 class AdminObservabilityApiTests(unittest.TestCase):
@@ -26,31 +26,22 @@ class AdminObservabilityApiTests(unittest.TestCase):
         settings = Settings(
             encryption_key=SecretVault.generate_key(),
             api_token="z" * 32,
-            admin_password="StartPass1",
             tushare_token="real-tushare-token-abcdef",
             db_path=Path(self.tmp.name) / "hub.db",
             scheduler_enabled=False,
         )
-        self.hub = Hub(settings, adapter=TushareAdapter("real-tushare-token-abcdef", transport=fake_transport))
+        self.site_auth = StubSiteAuth()
+        self.hub = Hub(
+            settings,
+            adapter=TushareAdapter("real-tushare-token-abcdef", transport=fake_transport),
+            site_auth=self.site_auth,
+        )
         handler = make_handler(self.hub)
         self.server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
         threading.Thread(target=self.server.serve_forever, daemon=True).start()
         self.base = f"http://127.0.0.1:{self.server.server_address[1]}"
-
-        _, body, cookie_header = self._json(
-            "/admin/api/login", "POST", {"username": "hub_admin", "password": "StartPass1"}
-        )
-        cookie = cookie_header.split(";")[0]
-        csrf = body["csrf"]
-        self._json(
-            "/admin/api/change-password",
-            "POST",
-            {"current": "StartPass1", "new_password": "NewPass123"},
-            cookie=cookie,
-            csrf=csrf,
-        )
-        self.cookie = cookie
-        self.csrf = csrf
+        self.cookie = f"xiaobai_session={StubSiteAuth.SESSION}"
+        self.csrf = self.site_auth.csrf_token(StubSiteAuth.SESSION)
 
     def tearDown(self) -> None:
         self.server.shutdown()
@@ -159,21 +150,17 @@ class AdminObservabilityApiTests(unittest.TestCase):
         finally:
             self.hub.db.observability_enabled = True
 
-    def test_must_change_password_blocks_new_endpoints_too(self) -> None:
+    def test_non_admin_site_accounts_cannot_read_the_new_endpoints(self) -> None:
         from urllib.error import HTTPError
 
-        _, body, cookie_header = self._json(
-            "/admin/api/login", "POST", {"username": "hub_admin", "password": "NewPass123"}
-        )
-        # Freshly logged-in user has already changed password in setUp, so
-        # this login should not require a change; verify the endpoint is
-        # reachable with a valid, non-must-change session (regression guard
-        # against accidentally bypassing the must-change gate for these new
-        # routes).
-        cookie = cookie_header.split(";")[0]
-        csrf = body["csrf"]
-        status, _, _ = self._json("/admin/api/source-catalog", cookie=cookie, csrf=csrf)
-        self.assertEqual(status, 200)
+        self.site_auth.add_session("member-session", StubSiteAuth.MEMBER)
+        with self.assertRaises(HTTPError) as ctx:
+            self._json("/admin/api/source-catalog", cookie="xiaobai_session=member-session")
+        self.assertEqual(ctx.exception.code, 403)
+
+        with self.assertRaises(HTTPError) as ctx:
+            self._json("/admin/api/source-catalog")
+        self.assertEqual(ctx.exception.code, 401)
 
 
 if __name__ == "__main__":