fix(saas): P0 安全修复 + P1 功能补全 — 角色提升、Admin 引导、IP 记录、密码修改

P0 安全修复:
- 修复 account update 自角色提升漏洞: 非 admin 用户更新自己时剥离 role 字段
- 添加 Admin 引导机制: accounts 表为空时自动从环境变量创建 super_admin

P1 功能补全:
- 所有 17 个 log_operation 调用点传入真实客户端 IP (ConnectInfo + X-Forwarded-For)
- AuthContext 新增 client_ip 字段, middleware 层自动提取
- main.rs 使用 into_make_service_with_connect_info 启用 SocketAddr 注入
- 新增 PUT /api/v1/auth/password 密码修改端点 (验证旧密码 + argon2 哈希)
- 桌面端 SaaS 设置页添加密码修改 UI (折叠式表单)
- SaaSClient 添加 changePassword() 方法
- 集成测试修复: 注入模拟 ConnectInfo 适配 onshot 测试模式

crates/zclaw-saas/src/auth/mod.rs

@@ -10,16 +10,18 @@ use axum::{
     http::header,
     middleware::Next,
     response::{IntoResponse, Response},
+    extract::ConnectInfo,
 };
 use secrecy::ExposeSecret;
 use crate::error::SaasError;
 use crate::state::AppState;
 use types::AuthContext;
+use std::net::SocketAddr;
 
 /// 通过 API Token 验证身份
 ///
 /// 流程: SHA-256 哈希 → 查 api_tokens 表 → 检查有效期 → 获取关联账号角色权限 → 更新 last_used_at
-async fn verify_api_token(state: &AppState, raw_token: &str) -> Result<AuthContext, SaasError> {
+async fn verify_api_token(state: &AppState, raw_token: &str, client_ip: Option<String>) -> Result<AuthContext, SaasError> {
     use sha2::{Sha256, Digest};
 
     let token_hash = hex::encode(Sha256::digest(raw_token.as_bytes()));
@@ -77,15 +79,36 @@ async fn verify_api_token(state: &AppState, raw_token: &str) -> Result<AuthConte
         account_id,
         role,
         permissions,
+        client_ip,
     })
 }
 
+/// 从请求中提取客户端 IP
+fn extract_client_ip(req: &Request) -> Option<String> {
+    // 优先从 ConnectInfo 获取
+    if let Some(ConnectInfo(addr)) = req.extensions().get::<ConnectInfo<SocketAddr>>() {
+        return Some(addr.ip().to_string());
+    }
+    // 回退到 X-Forwarded-For / X-Real-IP
+    if let Some(forwarded) = req.headers()
+        .get("x-forwarded-for")
+        .and_then(|v| v.to_str().ok())
+    {
+        return Some(forwarded.split(',').next()?.trim().to_string());
+    }
+    req.headers()
+        .get("x-real-ip")
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string())
+}
+
 /// 认证中间件: 从 JWT 或 API Token 提取身份
 pub async fn auth_middleware(
     State(state): State<AppState>,
     mut req: Request,
     next: Next,
 ) -> Response {
+    let client_ip = extract_client_ip(&req);
     let auth_header = req.headers()
         .get(header::AUTHORIZATION)
         .and_then(|v| v.to_str().ok());
@@ -94,7 +117,7 @@ pub async fn auth_middleware(
         if let Some(token) = auth.strip_prefix("Bearer ") {
             if token.starts_with("zclaw_") {
                 // API Token 路径
-                verify_api_token(&state, token).await
+                verify_api_token(&state, token, client_ip.clone()).await
             } else {
                 // JWT 路径
                 jwt::verify_token(token, state.jwt_secret.expose_secret())
@@ -102,6 +125,7 @@ pub async fn auth_middleware(
                         account_id: claims.sub,
                         role: claims.role,
                         permissions: claims.permissions,
+                        client_ip,
                     })
                     .map_err(|_| SaasError::Unauthorized)
             }
@@ -132,9 +156,10 @@ pub fn routes() -> axum::Router<AppState> {
 
 /// 需要认证的路由
 pub fn protected_routes() -> axum::Router<AppState> {
-    use axum::routing::{get, post};
+    use axum::routing::{get, post, put};
 
     axum::Router::new()
         .route("/api/v1/auth/refresh", post(handlers::refresh))
         .route("/api/v1/auth/me", get(handlers::me))
+        .route("/api/v1/auth/password", put(handlers::change_password))
 }