feat(auth): 添加认证模块和图片批注功能（项目初始化）

- 实现用户登录、登出、密码修改等认证功能
- 添加会话管理和权限控制中间件
- 创建图片批注组件和相关API路由
- 实现批注的增删改查功能
- 添加Docker和Git忽略配置文件
- 创建系统架构文档和开发约定说明
- 集成认证模块到前端应用路由中

api/configCrypto.ts

@@ -0,0 +1,38 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import dotenv from 'dotenv';
+
+dotenv.config();
+
+const dataDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'data');
+const localKeyPath = path.join(dataDir, '.config-encryption-key');
+
+function loadKey(): Buffer {
+  const configured = process.env.COS_CONFIG_ENCRYPTION_KEY?.trim();
+  if (configured) return createHash('sha256').update(configured, 'utf8').digest();
+
+  fs.mkdirSync(dataDir, { recursive: true });
+  if (!fs.existsSync(localKeyPath)) {
+    fs.writeFileSync(localKeyPath, randomBytes(32).toString('base64'), { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  }
+  return Buffer.from(fs.readFileSync(localKeyPath, 'utf8').trim(), 'base64');
+}
+
+const key = loadKey();
+
+export function encryptSecret(value: string): string {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+  return `v1:${iv.toString('base64')}:${cipher.getAuthTag().toString('base64')}:${encrypted.toString('base64')}`;
+}
+
+export function decryptSecret(value: string): string {
+  const [version, iv, tag, encrypted] = value.split(':');
+  if (version !== 'v1' || !iv || !tag || !encrypted) throw new Error('无法读取已保存的存储凭证');
+  const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'base64'));
+  decipher.setAuthTag(Buffer.from(tag, 'base64'));
+  return Buffer.concat([decipher.update(Buffer.from(encrypted, 'base64')), decipher.final()]).toString('utf8');
+}