feat: P0生产加固 — 认证安全+操作审计+错误提示

P0-1 认证安全:
- JWT secret 改为环境变量配置, 未设置则随机生成(重启失效)
- 新增 LoginRateLimitMiddleware: 5次/分钟登录频率限制(滑动窗口)
- 429 响应 + 前端 toast 提示

P0-2 操作审计日志:
- 新增 OperationLog 模型 (user/username/action/resource/detail/ip)
- 新增 AuditLogMiddleware 自动记录 POST/PUT/DELETE/PATCH 操作
- 新增 GET /audit-logs API (分页/过滤/统计)
- 前端 AuditLogsPage 对接真实 API (字段/路径修正)

P0-3 实例密码加密:
- 已确认 crypto.py AES-256-GCM 加密存储, 无需修改

P1 前端错误提示:
- 新增 useToast hook + ToastContainer 组件
- request.ts 拦截器: 4xx/5xx 错误 toast 显示后端 detail 信息
- 422 验证错误提取第一条 msg
- 网络失败显示通用提示

1182 tests passed

backend/app/services/audit_logger.py

@@ -0,0 +1,45 @@
+"""操作审计日志服务 — 轻量级，各 endpoint 直接调用。"""
+from typing import Optional
+from sqlalchemy.ext.asyncio import AsyncSession
+from fastapi import Request
+
+from app.models.operation_log import OperationLog
+
+
+async def log_operation(
+    db: AsyncSession,
+    *,
+    action: str,
+    resource_type: Optional[str] = None,
+    resource_id: Optional[int] = None,
+    detail: Optional[str] = None,
+    user_id: Optional[int] = None,
+    username: Optional[str] = None,
+    request: Optional[Request] = None,
+) -> None:
+    """记录操作日志（fire-and-forget，不抛异常）。"""
+    try:
+        ip_address = None
+        user_agent = None
+        if request:
+            forwarded = request.headers.get("x-forwarded-for")
+            ip_address = forwarded.split(",")[0].strip() if forwarded else (
+                request.client.host if request.client else None
+            )
+            user_agent = request.headers.get("user-agent", "")[:255]
+
+        log = OperationLog(
+            user_id=user_id,
+            username=username,
+            action=action,
+            resource_type=resource_type,
+            resource_id=resource_id,
+            detail=detail,
+            ip_address=ip_address,
+            user_agent=user_agent,
+        )
+        db.add(log)
+        await db.flush()
+    except Exception:
+        # 审计日志不应影响业务流程
+        pass