[阶段1.1-1.7] 实现完整的认证系统

后端实现:
- 创建 AuthService 包含密码加密、JWT 生成和验证
- 创建 authMiddleware 用于 API 路由保护
- 实现 auth 路由 (register, login, logout, /me)

前端实现:
- 创建 Login 页面 (登录/注册标签页)
- 创建 ProtectedRoute 组件用于路由保护
- 更新 App.tsx 集成路由保护
- 前端 API 客户端已包含认证方法和拦截器

验收标准已满足:
- 用户可以注册和登录
- JWT Token 正确生成和验证
- 受保护的路由需要有效 Token
- 未认证用户重定向到登录页面

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app.py

@@ -0,0 +1,50 @@
+"""
+Flask application factory for Garmin Health Lab.
+
+Run directly (`python app.py`) for development, or serve with Gunicorn:
+    gunicorn wsgi:app -b 0.0.0.0:5000
+"""
+from flask import Flask, jsonify
+from flask_cors import CORS
+
+import db
+from config import CORS_ORIGINS, PORT
+from routes import auth, garmin, health, analysis
+
+
+def create_app():
+    app = Flask(__name__)
+    CORS(app, resources={r"/api/*": {"origins": CORS_ORIGINS}}, supports_credentials=True)
+
+    # Create tables once at startup (idempotent).
+    db.init_db()
+
+    @app.route("/")
+    def index():
+        return jsonify({"name": "Garmin Health Lab API", "version": "1.0.0"})
+
+    @app.route("/api/health/status")
+    def health_status():
+        return jsonify({"status": "ok", "db": db.DB_TYPE})
+
+    app.register_blueprint(auth.bp, url_prefix="/api/auth")
+    app.register_blueprint(garmin.bp, url_prefix="/api/garmin")
+    app.register_blueprint(health.bp, url_prefix="/api/health")
+    app.register_blueprint(analysis.bp, url_prefix="/api/analysis")
+
+    @app.errorhandler(404)
+    def not_found(_e):
+        return jsonify({"error": "not found"}), 404
+
+    @app.errorhandler(500)
+    def server_error(_e):
+        return jsonify({"error": "internal error"}), 500
+
+    return app
+
+
+app = create_app()
+
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=PORT, debug=False)