施工(HEL-226): 实现登录门户与本机免密切换账号

用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

frontend/m/js/router.js

@@ -250,6 +250,7 @@
       '<h2>小白复盘</h2>',
       '<p>登录后进入你的复盘空间</p>',
       "</div>",
+      '<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
       '<div class="m-auth-tabs">',
       '<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
       '<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
@@ -265,6 +266,7 @@
     ].join("");
     authMode = "login";
     bindAuth();
+    loadMobileAccounts();
   }
 
   function setAuthMode(mode) {
@@ -287,6 +289,34 @@
     document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
   }
 
+  async function loadMobileAccounts() {
+    const host = document.getElementById("m-auth-accounts");
+    if (!host || !global.MobileSession.listAccounts) return;
+    try {
+      const payload = await global.MobileSession.listAccounts();
+      const accounts = payload.accounts || [];
+      if (!accounts.length) return;
+      host.hidden = false;
+      host.innerHTML = accounts.map(function (account) {
+        return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
+          '<strong>' + escapeHtml(account.username) + '</strong>' +
+          '<span>直接进入</span></button>';
+      }).join("");
+      host.querySelectorAll("[data-switch-id]").forEach(function (button) {
+        button.addEventListener("click", async function () {
+          try {
+            await global.MobileSession.switchAccount(Number(button.dataset.switchId));
+            replace(DEFAULT_HASH);
+          } catch (error) {
+            showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
+          }
+        });
+      });
+    } catch (_error) {
+      host.hidden = true;
+    }
+  }
+
   function showAuthError(element, message) {
     element.textContent = message;
     element.classList.remove("m-motion-fade-in");