feat(HEL-560): 数据中枢接管数据源/模型池/会员，注册改一次性邀请码

主站
- 新增 m0006 invite_codes 迁移；注册强制邀请码（首个管理员除外），消码与建号
  同一事务，并发提交只有一个能成功
- 新增 /api/hub-admin/* 服务端点（共享 HUB_ADMIN_TOKEN，先于鉴权校验），供数据
  中枢桥接读写会话/密码/模型池/会员/邀请码，并提供供应商模型列表拉取
- 前端：注册表单加邀请码（桌面 login、index.html、移动端）；「系统管理」改为
  「数据中枢」入口指向 8766，原模型池与会员管理分区移除，仅留「行情管理」；
  随之清理陈旧 CSS

数据中枢
- 取消独立账号：删除 hub_admin/hub_sessions 与登录、改密、锁定逻辑，改为校验
  主站 xiaobai_session，仅管理员可进，CSRF 由会话派生，危险操作二次确认走主站
- 控制台新增数据源凭证可编辑区（原有内容一项不删）、供应商制模型池（自动拉取
  /models，失败退回卡内手动录入）、会员管理与邀请码页
- 日夜双主题：颜色收敛为同名 token 换值，SVG 改用 inline style 以吃到变量

自测
- 主站 verify_baseline 通过（498 项）；数据中枢 235 项通过
- tools/verify_datahub_console.py 端到端跑通两服务真实对话；
  tools/verify_datahub_console_ui.py 浏览器跑通门禁/凭证/模型池/会员/主题/1030 窄屏

Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/test_atomic_release.py

@@ -52,7 +52,6 @@ def make_pipe(transport: GroupTransport, quality_extra: dict | None = None):
     settings = Settings(
         encryption_key=SecretVault.generate_key(),
         api_token="t" * 32,
-        admin_password="admin-pass",
         tushare_token="test-token",
         db_path=db.path,
         quality=quality,
@@ -361,18 +360,22 @@ class ForceBoundaryEntryTests(unittest.TestCase):
         from datahub.scheduler import Scheduler
         from datahub.serving import ApiError
 
+        from tests.fixtures import StubSiteAuth
+
         vault = SecretVault(self.pipe.settings.encryption_key)
-        auth = AuthService(self.db, vault, self.pipe.settings.api_token, "StartPass1")
-        admin = AdminAPI(self.db, self.pipe, Scheduler(self.db, self.pipe), auth)
+        auth = AuthService(self.db, vault, self.pipe.settings.api_token)
+        # 危险操作的第二因子现在是主站账号口令（HEL-560），不再有本地管理员密码
+        site_auth = StubSiteAuth(password="StartPass1")
+        admin = AdminAPI(self.db, self.pipe, Scheduler(self.db, self.pipe), auth, site_auth=site_auth)
         before = publications_map(self.db, TRADE_DATE)
-        result = admin.backfill("moneyflow", TRADE_DATE, "StartPass1", f"moneyflow:{TRADE_DATE}", "tester")
+        result = admin.backfill("moneyflow", TRADE_DATE, "StartPass1", f"moneyflow:{TRADE_DATE}", "tester", 1)
         self.assertEqual(result["moneyflow"]["state"], "published")
         after = publications_map(self.db, TRADE_DATE)
         for name in (*GROUP_A, "stocks"):
             self.assertNotEqual(after[name], before[name], name)
         # bad password / wrong confirm still rejected
         with self.assertRaises(ApiError):
-            admin.backfill("daily", TRADE_DATE, "wrong", f"daily:{TRADE_DATE}", "tester")
+            admin.backfill("daily", TRADE_DATE, "wrong", f"daily:{TRADE_DATE}", "tester", 1)
 
     def test_admin_backfill_switch_crash_is_failed_precondition(self) -> None:
         from datahub.admin_api import AdminAPI
@@ -381,9 +384,13 @@ class ForceBoundaryEntryTests(unittest.TestCase):
         from datahub.scheduler import Scheduler
         from datahub.serving import ApiError
 
+        from tests.fixtures import StubSiteAuth
+
         vault = SecretVault(self.pipe.settings.encryption_key)
-        auth = AuthService(self.db, vault, self.pipe.settings.api_token, "StartPass1")
-        admin = AdminAPI(self.db, self.pipe, Scheduler(self.db, self.pipe), auth)
+        auth = AuthService(self.db, vault, self.pipe.settings.api_token)
+        # 危险操作的第二因子现在是主站账号口令（HEL-560），不再有本地管理员密码
+        site_auth = StubSiteAuth(password="StartPass1")
+        admin = AdminAPI(self.db, self.pipe, Scheduler(self.db, self.pipe), auth, site_auth=site_auth)
         before = publications_map(self.db, TRADE_DATE)
 
         def explode() -> None:
@@ -391,7 +398,7 @@ class ForceBoundaryEntryTests(unittest.TestCase):
 
         self.pipe.before_commit = explode
         with self.assertRaises(ApiError) as ctx:
-            admin.backfill("valuation", TRADE_DATE, "StartPass1", f"valuation:{TRADE_DATE}", "tester")
+            admin.backfill("valuation", TRADE_DATE, "StartPass1", f"valuation:{TRADE_DATE}", "tester", 1)
         self.assertEqual(ctx.exception.code, "FAILED_PRECONDITION")
         self.assertIn("killed mid-switch", ctx.exception.message)
         # previous complete A/B versions keep serving