全局整改: 布局重构、鉴权加固、API修复

- 首页/播放页: 去掉 antd Layout 改用 div 避免 flex 布局问题
- 播放页: 返回按钮改为 navigate('/') 替代 window.close()
- 后端登录/验证: 改用 POST JSON body 替代 query param
- 后端鉴权: require_auth 依赖注入保护所有管理接口
- nodes路由: 修复 /strategy 被 /{node_id} 拦截的顺序问题
- 前端 Settings: 策略更新改为 JSON body

backend/routes/streams.py

@@ -3,6 +3,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from pydantic import BaseModel
 from typing import Optional
 from database import get_db
+from routes.auth import require_auth
 from services.stream_service import StreamService
 from services.media_service import media_service
 from services.load_balancer import lb
@@ -48,7 +49,8 @@ async def list_streams(db: AsyncSession = Depends(get_db)):
 
 
 @router.post("")
-async def create_stream(body: StreamCreate, db: AsyncSession = Depends(get_db)):
+async def create_stream(body: StreamCreate, db: AsyncSession = Depends(get_db),
+                        _: bool = Depends(require_auth)):
     svc = StreamService(db)
     stream = await svc.create_stream(
         title=body.title,
@@ -88,7 +90,8 @@ async def get_stream(stream_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.put("/{stream_id}")
-async def update_stream(stream_id: int, body: StreamUpdate, db: AsyncSession = Depends(get_db)):
+async def update_stream(stream_id: int, body: StreamUpdate, db: AsyncSession = Depends(get_db),
+                        _: bool = Depends(require_auth)):
     svc = StreamService(db)
     existing = await svc.get_stream(stream_id)
     if not existing:
@@ -100,7 +103,8 @@ async def update_stream(stream_id: int, body: StreamUpdate, db: AsyncSession = D
 
 
 @router.delete("/{stream_id}")
-async def delete_stream(stream_id: int, db: AsyncSession = Depends(get_db)):
+async def delete_stream(stream_id: int, db: AsyncSession = Depends(get_db),
+                        _: bool = Depends(require_auth)):
     svc = StreamService(db)
     existing = await svc.get_stream(stream_id)
     if not existing:
@@ -127,7 +131,8 @@ async def get_watch_urls(stream_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.post("/{stream_id}/go-live")
-async def stream_go_live(stream_id: int, db: AsyncSession = Depends(get_db)):
+async def stream_go_live(stream_id: int, db: AsyncSession = Depends(get_db),
+                         _: bool = Depends(require_auth)):
     svc = StreamService(db)
     stream = await svc.get_stream(stream_id)
     if not stream:
@@ -137,7 +142,8 @@ async def stream_go_live(stream_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.post("/{stream_id}/end")
-async def stream_end(stream_id: int, db: AsyncSession = Depends(get_db)):
+async def stream_end(stream_id: int, db: AsyncSession = Depends(get_db),
+                     _: bool = Depends(require_auth)):
     svc = StreamService(db)
     stream = await svc.get_stream(stream_id)
     if not stream: