feat(client): add authorized WireGuard device enrollment and desktop connection

backend/internal/api/api.go

@@ -217,6 +217,20 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 	api.POST("/login", s.login)
 	api.GET("/health", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
 
+	// 终端用户客户端 API（桌面/移动端）：独立令牌，与管理会话隔离
+	api.POST("/client/login", s.clientLogin)
+	api.GET("/client/capabilities", func(c *gin.Context) { c.JSON(200, gin.H{"password": true, "oidc": false, "wireguard": true}) })
+	cli := api.Group("/client", clientAuth())
+	{
+		cli.POST("/logout", s.clientLogout)
+		cli.GET("/lines", s.clientLines)
+		cli.GET("/devices", s.clientListDevices)
+		cli.POST("/devices", s.clientRegisterDevice)
+		cli.GET("/devices/:id/config", s.clientDeviceConfig)
+		cli.GET("/devices/:id/status", s.clientDeviceStatus)
+		cli.DELETE("/devices/:id", s.clientRevokeDevice)
+	}
+
 	auth := api.Group("")
 	auth.Use(authMiddleware(), requirePasswordChanged())
 	{
@@ -317,6 +331,8 @@ func (s *Server) RegisterRoutes(r *gin.Engine) {
 		admin.POST("/vpn-users/:id/mfa/backup-codes", s.vpnUserMFABackupCodes)
 		admin.POST("/vpn-users/:id/mfa/unlock", s.vpnUserMFAUnlock)
 		admin.GET("/vpn-users/:id/mfa/otp-secrets", s.vpnUserOTPSecretsLine)
+		admin.GET("/client-devices", s.adminListClientDevices)
+		admin.POST("/client-devices/:id/revoke", s.adminRevokeClientDevice)
 		admin.POST("/nodes", s.createNode)
 		admin.POST("/nodes/test", s.testNodeConnection)
 		admin.PUT("/nodes/:id", s.updateNode)