[阶段1.1-1.7] 实现完整的认证系统

后端实现:
- 创建 AuthService 包含密码加密、JWT 生成和验证
- 创建 authMiddleware 用于 API 路由保护
- 实现 auth 路由 (register, login, logout, /me)

前端实现:
- 创建 Login 页面 (登录/注册标签页)
- 创建 ProtectedRoute 组件用于路由保护
- 更新 App.tsx 集成路由保护
- 前端 API 客户端已包含认证方法和拦截器

验收标准已满足:
- 用户可以注册和登录
- JWT Token 正确生成和验证
- 受保护的路由需要有效 Token
- 未认证用户重定向到登录页面

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/routes/auth.py

@@ -0,0 +1,59 @@
+"""Auth routes: register / login / logout / refresh."""
+import uuid
+
+from flask import Blueprint, request, g, jsonify
+
+from auth import hash_password, verify_password, sign_token, require_auth
+from db import execute, query_one
+
+bp = Blueprint("auth", __name__)
+
+
+@bp.route("/register", methods=["POST"])
+def register():
+    data = request.get_json(silent=True) or {}
+    email = (data.get("email") or "").strip()
+    garmin_email = (data.get("garminEmail") or "").strip()
+    garmin_password = data.get("garminPassword") or ""
+    if not email or not garmin_email or not garmin_password:
+        return jsonify({"error": "email, garminEmail, garminPassword 均为必填"}), 400
+
+    if query_one("SELECT id FROM users WHERE email = ?", [email]):
+        return jsonify({"error": "该邮箱已注册"}), 409
+
+    uid = str(uuid.uuid4())
+    token = sign_token(uid)
+    execute(
+        "INSERT INTO users (id, email, garmin_email, garmin_password_hash, jwt_token) "
+        "VALUES (?, ?, ?, ?, ?)",
+        [uid, email, garmin_email, hash_password(garmin_password), token],
+    )
+    return jsonify({"id": uid, "email": email, "token": token}), 201
+
+
+@bp.route("/login", methods=["POST"])
+def login():
+    data = request.get_json(silent=True) or {}
+    email = (data.get("email") or "").strip()
+    password = data.get("password") or ""
+    user = query_one("SELECT * FROM users WHERE email = ?", [email])
+    if not user or not verify_password(password, user["garmin_password_hash"]):
+        return jsonify({"error": "邮箱或密码错误"}), 401
+    token = sign_token(user["id"])
+    execute("UPDATE users SET jwt_token = ? WHERE id = ?", [token, user["id"]])
+    return jsonify({"id": user["id"], "email": user["email"], "token": token})
+
+
+@bp.route("/logout", methods=["POST"])
+@require_auth
+def logout():
+    execute("UPDATE users SET jwt_token = NULL WHERE id = ?", [g.user_id])
+    return jsonify({"message": "ok"})
+
+
+@bp.route("/refresh", methods=["POST"])
+@require_auth
+def refresh():
+    token = sign_token(g.user_id)
+    execute("UPDATE users SET jwt_token = ? WHERE id = ?", [token, g.user_id])
+    return jsonify({"token": token})