feat: Web后台登录认证

- 新增登录页面 (templates/login.html)
- HMAC-SHA256 cookie 认证中间件
- 所有页面和API需登录访问
- /health 保持公开
- 首页右上角退出按钮
- 默认账号 admin/admin123
- Cookie 有效期7天
- 版本升级至 v1.1.0

templates/index.html

@@ -11,6 +11,9 @@ body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-
 .header { background: linear-gradient(135deg, #ff6b6b, #ee5a24); color: #fff; padding: 20px; text-align: center; position: sticky; top: 0; z-index: 100; box-shadow: 0 2px 10px rgba(0,0,0,.15); }
 .header h1 { font-size: 24px; margin-bottom: 4px; }
 .header .subtitle { font-size: 13px; opacity: .85; }
+.header { position: relative; }
+.logout-btn { position: absolute; right: 16px; top: 50%; transform: translateY(-50%); background: rgba(255,255,255,.2); color: #fff; text-decoration: none; padding: 5px 14px; border-radius: 6px; font-size: 13px; transition: background .2s; }
+.logout-btn:hover { background: rgba(255,255,255,.35); }
 
 .stats { display: flex; gap: 10px; padding: 15px; overflow-x: auto; }
 .stat-card { flex: 1; min-width: 120px; background: #fff; border-radius: 12px; padding: 15px; text-align: center; box-shadow: 0 2px 8px rgba(0,0,0,.06); }
@@ -67,6 +70,7 @@ body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-
 <div class="header">
   <h1>🦞 虾记记账</h1>
   <div class="subtitle">Xiaji-Go 记账管理</div>
+  <a href="/logout" class="logout-btn" title="退出登录">退出</a>
 </div>
 
 <div class="stats">