feat: 实现用户登录认证与权限控制系统

- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me）
- 引入基于密码哈希的认证机制，支持默认管理员账号登录
- 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证
- 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据
- 更新应用布局，要求用户登录后才能访问主界面
- 扩展用户表结构，增加用户名和密码哈希字段
- 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据
- 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认
- 优化“我的KR”页面，为管理员提供全员KR概览视图
- 修复.gitignore文件中的拼写错误（.trae → .travis）
- 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等
- 配置Next.js以支持独立输出和子路径部署

components/user-context.tsx

@@ -8,8 +8,11 @@ interface UserContextType {
   users: User[];
   isLoading: boolean;
   isInitialized: boolean;
+  isAuthenticated: boolean;
   setCurrentUserId: (id: string) => void;
+  logout: () => void;
   refreshUsers: () => Promise<void>;
+  refreshMe: () => Promise<User | null>;
 }
 
 const UserContext = createContext<UserContextType | undefined>(undefined);
@@ -19,6 +22,7 @@ export function UserProvider({ children }: { children: ReactNode }) {
   const [users, setUsers] = useState<User[]>([]);
   const [isLoading, setIsLoading] = useState(true);
   const [isInitialized, setIsInitialized] = useState(false);
+  const [isAuthenticated, setIsAuthenticated] = useState(false);
 
   const refreshUsers = useCallback(async () => {
     try {
@@ -34,43 +38,82 @@ export function UserProvider({ children }: { children: ReactNode }) {
     return [];
   }, []);
 
+  const refreshMe = useCallback(async () => {
+    try {
+      const meRes = await fetch('/api/auth/me', { cache: 'no-store' });
+      const meData = await meRes.json().catch(() => ({}));
+      const me = meData?.user as User | null | undefined;
+
+      if (me && me.id) {
+        setCurrentUser(me);
+        setIsAuthenticated(true);
+        localStorage.setItem('okrAuthUserId', me.id);
+        localStorage.setItem('currentUserId', me.id);
+        await refreshUsers();
+        return me;
+      }
+
+      localStorage.removeItem('okrAuthUserId');
+      localStorage.removeItem('currentUserId');
+      setCurrentUser(null);
+      setIsAuthenticated(false);
+      setUsers([]);
+      return null;
+    } catch (error) {
+      console.error('Failed to refresh auth:', error);
+      localStorage.removeItem('okrAuthUserId');
+      localStorage.removeItem('currentUserId');
+      setCurrentUser(null);
+      setIsAuthenticated(false);
+      setUsers([]);
+      return null;
+    }
+  }, [refreshUsers]);
+
   useEffect(() => {
     async function init() {
       setIsLoading(true);
-      const fetchedUsers = await refreshUsers();
-
-      if (fetchedUsers.length > 0) {
-        const storedId = localStorage.getItem('currentUserId');
-        const foundUser = storedId
-          ? fetchedUsers.find((u: User) => u.id === storedId)
-          : null;
-
-        if (foundUser) {
-          setCurrentUser(foundUser);
-        } else {
-          const owner = fetchedUsers.find((u: User) => u.role === 'owner') || fetchedUsers[0];
-          setCurrentUser(owner);
-          localStorage.setItem('currentUserId', owner.id);
-        }
+      try {
+        await refreshMe();
+      } catch (error) {
+        console.error('Failed to initialize auth:', error);
+        localStorage.removeItem('okrAuthUserId');
+        localStorage.removeItem('currentUserId');
+        setCurrentUser(null);
+        setIsAuthenticated(false);
+        setUsers([]);
+      } finally {
         setIsInitialized(true);
+        setIsLoading(false);
       }
-
-      setIsLoading(false);
     }
 
     init();
-  }, [refreshUsers]);
+  }, [refreshMe]);
 
   const setCurrentUserId = useCallback((id: string) => {
+    const authUserId = localStorage.getItem('okrAuthUserId');
+    if (!authUserId) return;
+    if (authUserId !== id) return;
     const user = users.find(u => u.id === id);
     if (user) {
       setCurrentUser(user);
       localStorage.setItem('currentUserId', id);
+      setIsAuthenticated(true);
     }
   }, [users]);
 
+  const logout = useCallback(() => {
+    localStorage.removeItem('okrAuthUserId');
+    localStorage.removeItem('currentUserId');
+    setCurrentUser(null);
+    setIsAuthenticated(false);
+    setUsers([]);
+    fetch('/api/auth/logout', { method: 'POST' }).catch(() => {});
+  }, []);
+
   return (
-    <UserContext.Provider value={{ currentUser, users, isLoading, isInitialized, setCurrentUserId, refreshUsers }}>
+    <UserContext.Provider value={{ currentUser, users, isLoading, isInitialized, isAuthenticated, setCurrentUserId, logout, refreshUsers, refreshMe }}>
       {children}
     </UserContext.Provider>
   );