feat(auth): 添加认证模块和图片批注功能（项目初始化）

- 实现用户登录、登出、密码修改等认证功能
- 添加会话管理和权限控制中间件
- 创建图片批注组件和相关API路由
- 实现批注的增删改查功能
- 添加Docker和Git忽略配置文件
- 创建系统架构文档和开发约定说明
- 集成认证模块到前端应用路由中

scripts/migrate-sqlite-to-postgres.ts

@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+import pg from 'pg';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error('缺少 DATABASE_URL，迁移未执行');
+
+const replace = process.argv.includes('--replace');
+const sqlitePath = path.resolve(process.env.SQLITE_PATH || 'data/app.db');
+const schemaPath = path.resolve('db/postgres/schema.sql');
+if (!fs.existsSync(sqlitePath)) throw new Error(`SQLite 数据库不存在：${sqlitePath}`);
+
+const tables = [
+  'operation_groups', 'users', 'projects', 'collections', 'notes', 'images', 'annotations',
+  'work_comments', 'work_versions', 'review_events', 'sessions', 'customer_sessions',
+  'audit_logs', 'api_keys', 'storage_configs',
+] as const;
+const booleanColumns: Record<string, Set<string>> = {
+  users: new Set(['must_change_password']),
+  projects: new Set(['customer_access_enabled']),
+};
+
+const sqlite = new Database(sqlitePath, { readonly: true });
+const client = new pg.Client({ connectionString: databaseUrl, ssl: process.env.PGSSL === 'disable' ? false : undefined });
+
+try {
+  await client.connect();
+  await client.query(fs.readFileSync(schemaPath, 'utf8'));
+  const existing = Number((await client.query('SELECT COUNT(*)::int AS count FROM operation_groups')).rows[0].count);
+  if (existing && !replace) throw new Error('PostgreSQL 已有数据。确认覆盖时请显式添加 --replace');
+  await client.query('BEGIN');
+  if (replace) await client.query(`TRUNCATE ${[...tables].reverse().map((table) => `"${table}"`).join(', ')} RESTART IDENTITY CASCADE`);
+
+  for (const table of tables) {
+    const exists = sqlite.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+    if (!exists) continue;
+    const rows = sqlite.prepare(`SELECT * FROM "${table}" ORDER BY id`).all() as Record<string, unknown>[];
+    for (const row of rows) {
+      const columns = Object.keys(row);
+      const values = columns.map((column) => booleanColumns[table]?.has(column) ? Boolean(row[column]) : row[column]);
+      const names = columns.map((column) => `"${column}"`).join(', ');
+      const placeholders = columns.map((_, index) => `$${index + 1}`).join(', ');
+      await client.query(`INSERT INTO "${table}" (${names}) VALUES (${placeholders})`, values);
+    }
+    if (rows.length) await client.query(`SELECT setval(pg_get_serial_sequence('${table}', 'id'), (SELECT MAX(id) FROM "${table}"), true)`);
+  }
+  await client.query('COMMIT');
+  process.stdout.write(`迁移完成：${tables.length} 张表已从 ${sqlitePath} 导入 PostgreSQL\n`);
+} catch (error) {
+  await client.query('ROLLBACK').catch(() => undefined);
+  throw error;
+} finally {
+  sqlite.close();
+  await client.end().catch(() => undefined);
+}