feat(auth): 添加异步密码哈希和验证函数

refactor(relay): 复用HTTP客户端和请求体序列化结果

feat(kernel): 添加获取单个审批记录的方法

fix(store): 改进SaaS连接错误分类和降级处理

docs: 更新审计文档和系统架构文档

refactor(prompt): 优化SQL查询参数化绑定

refactor(migration): 使用静态SQL和COALESCE更新配置项

feat(commands): 添加审批执行状态追踪和事件通知

chore: 更新启动脚本以支持Admin后台

fix(auth-guard): 优化授权状态管理和错误处理

refactor(db): 使用异步密码哈希函数

refactor(totp): 使用异步密码验证函数

style: 清理无用文件和注释

docs: 更新功能全景和审计文档

refactor(service): 优化HTTP客户端重用和请求处理

fix(connection): 改进SaaS不可用时的降级处理

refactor(handlers): 使用异步密码验证函数

chore: 更新依赖和工具链配置

start-all.ps1

@@ -1,5 +1,5 @@
 # ZCLAW Full Stack Start Script
-# Starts: PostgreSQL (Docker) -> SaaS Backend -> ChromeDriver (optional) -> Tauri Desktop
+# Starts: PostgreSQL (Docker) -> SaaS Backend -> Admin Web -> ChromeDriver (optional) -> Tauri Desktop
 #
 # NOTE: ZCLAW now uses internal Kernel (zclaw-kernel) for all operations.
 # No external ZCLAW runtime is required.
@@ -33,7 +33,7 @@ Usage: .\start-all.ps1 [options]
 Options:
     -DesktopOnly    Start desktop only (skip ChromeDriver + SaaS + PostgreSQL)
     -NoBrowser      Skip ChromeDriver startup
-    -NoSaas         Skip PostgreSQL + SaaS backend startup
+    -NoSaas         Skip PostgreSQL + SaaS backend + Admin dashboard startup
     -Dev            Development mode (hot reload)
     -Stop           Stop all services
     -Help           Show this help
@@ -59,13 +59,16 @@ if ($Stop) {
     Get-Process -Name "chromedriver" -ErrorAction SilentlyContinue | Stop-Process -Force
     ok "ChromeDriver stopped"
 
-    # Stop SaaS backend
-    Get-Process -Name "zclaw-saas" -ErrorAction SilentlyContinue | Stop-Process -Force
+    # Stop SaaS backend (kill process tree)
+    Get-Process -Name "zclaw-saas" -ErrorAction SilentlyContinue | ForEach-Object {
+        & taskkill /T /F /PID $_.Id 2>$null
+        ok "Stopped SaaS backend process tree (PID: $($_.Id))"
+    }
     $port8080 = netstat -ano | Select-String ":8080.*LISTENING"
     if ($port8080) {
         $pid8080 = ($port8080 -split '\s+')[-1]
         if ($pid8080 -match '^\d+$') {
-            Stop-Process -Id $pid8080 -Force -ErrorAction SilentlyContinue
+            & taskkill /T /F /PID $pid8080 2>$null
             ok "Stopped SaaS backend on port 8080 (PID: $pid8080)"
         }
     }
@@ -75,11 +78,21 @@ if ($Stop) {
     if ($port4200) {
         $pid4200 = ($port4200 -split '\s+')[-1]
         if ($pid4200 -match '^\d+$') {
-            Stop-Process -Id $pid4200 -Force -ErrorAction SilentlyContinue
+            & taskkill /T /F /PID $pid4200 2>$null
             ok "Stopped process on port 4200 (PID: $pid4200)"
         }
     }
 
+    # Stop Admin dev server (kill process tree to ensure node.exe children die)
+    $port3000 = netstat -ano | Select-String ":3000.*LISTENING"
+    if ($port3000) {
+        $pid3000 = ($port3000 -split '\s+')[-1]
+        if ($pid3000 -match '^\d+$') {
+            & taskkill /T /F /PID $pid3000 2>$null
+            ok "Stopped Admin dev server on port 3000 (PID: $pid3000)"
+        }
+    }
+
     # Stop Tauri/ZClaw
     Get-Process -Name "ZClaw" -ErrorAction SilentlyContinue | Stop-Process -Force
     Get-Process -Name "desktop" -ErrorAction SilentlyContinue | Stop-Process -Force
@@ -90,7 +103,7 @@ if ($Stop) {
     if ($port1420) {
         $pid1420 = ($port1420 -split '\s+')[-1]
         if ($pid1420 -match '^\d+$') {
-            Stop-Process -Id $pid1420 -Force -ErrorAction SilentlyContinue
+            & taskkill /T /F /PID $pid1420 2>$null
             ok "Killed process on port 1420 (PID: $pid1420)"
         }
     }
@@ -110,10 +123,28 @@ $Jobs = @()
 
 function Cleanup {
     info "Cleaning up..."
+    # Kill tracked process trees (parent + all children)
     foreach ($job in $Jobs) {
         if ($job -and !$job.HasExited) {
-            info "Stopping $($job.ProcessName) (PID: $($job.Id))"
-            try { $job.Kill() } catch {}
+            info "Stopping $($job.ProcessName) (PID: $($job.Id)) and child processes"
+            try {
+                # taskkill /T kills the entire process tree, not just the parent
+                & taskkill /T /F /PID $job.Id 2>$null
+                if (!$job.HasExited) { $job.Kill() }
+            } catch {
+                try { $job.Kill() } catch {}
+            }
+        }
+    }
+    # Fallback: kill processes by known ports
+    foreach ($port in @(8080, 3000)) {
+        $listening = netstat -ano | Select-String ":${port}.*LISTENING"
+        if ($listening) {
+            $pid = ($listening -split '\s+')[-1]
+            if ($pid -match '^\d+$') {
+                info "Killing orphan process on port $port (PID: $pid)"
+                & taskkill /T /F /PID $pid 2>$null
+            }
         }
     }
 }
@@ -203,7 +234,48 @@ if (-not $NoSaas) {
 
 Write-Host ""
 
-# 3. ChromeDriver (optional - for Browser Hand automation)
+# 3. Admin Web (Next.js management dashboard on port 3000)
+if (-not $NoSaas) {
+    info "Checking Admin dashboard..."
+
+    $port3000 = netstat -ano | Select-String ":3000.*LISTENING"
+    if ($port3000) {
+        $pid3000 = ($port3000 -split '\s+')[-1]
+        if ($pid3000 -match '^\d+$') {
+            ok "Admin dashboard already running on port 3000 (PID: $pid3000)"
+        }
+    } else {
+        if (Test-Path "$ScriptDir\admin\package.json") {
+            info "Starting Admin dashboard on port 3000..."
+            Set-Location "$ScriptDir\admin"
+
+            if ($Dev) {
+                $proc = Start-Process -FilePath "cmd.exe" -ArgumentList "/c cd /d `"$ScriptDir\admin`" && pnpm dev" -PassThru -WindowStyle Minimized
+            } else {
+                $proc = Start-Process -FilePath "cmd.exe" -ArgumentList "/c cd /d `"$ScriptDir\admin`" && pnpm dev" -PassThru -WindowStyle Minimized
+            }
+            $Jobs += $proc
+            Set-Location $ScriptDir
+            Start-Sleep -Seconds 5
+
+            $port3000Check = netstat -ano | Select-String ":3000.*LISTENING"
+            if ($port3000Check) {
+                ok "Admin dashboard started on port 3000 (PID: $($proc.Id))"
+            } else {
+                warn "Admin dashboard may still be starting. Check http://localhost:3000"
+            }
+        } else {
+            warn "Admin directory not found. Skipping."
+        }
+    }
+} else {
+    info "Skipping Admin dashboard"
+}
+
+Write-Host ""
+
+# 4. ChromeDriver (optional - for Browser Hand automation)
+
 if (-not $NoBrowser) {
     info "Checking ChromeDriver..."
 
@@ -236,7 +308,7 @@ if (-not $NoBrowser) {
 
 Write-Host ""
 
-# 4. Start Tauri Desktop
+# 5. Start Tauri Desktop
 info "Starting ZCLAW Desktop..."
 Set-Location "$ScriptDir/desktop"