feat: add username/password login, account settings, and changelog (#133) (#134)

- Add username/password login as additional auth mechanism alongside existing token
- First login must use token; password can be configured in Settings > Account
- Password login returns the existing static token (no auth middleware changes)
- Add account settings: setup, change password, change username, remove password
- Add logout button to sidebar footer
- Add version changelog popup (click version number in sidebar)
- Support all 8 locales (en, zh, de, es, fr, ja, ko, pt)
- Bump version to 0.4.3

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

packages/server/src/routes/auth.ts

@@ -0,0 +1,14 @@
+import Router from '@koa/router'
+import * as ctrl from '../controllers/auth'
+
+// Public routes (no auth required)
+export const authPublicRoutes = new Router()
+authPublicRoutes.get('/api/auth/status', ctrl.authStatus)
+authPublicRoutes.post('/api/auth/login', ctrl.login)
+
+// Protected routes (auth required)
+export const authProtectedRoutes = new Router()
+authProtectedRoutes.post('/api/auth/setup', ctrl.setupPassword)
+authProtectedRoutes.post('/api/auth/change-password', ctrl.changePassword)
+authProtectedRoutes.post('/api/auth/change-username', ctrl.changeUsername)
+authProtectedRoutes.delete('/api/auth/password', ctrl.removePassword)

packages/server/src/routes/index.ts

@@ -5,6 +5,7 @@ import { healthRoutes } from './health'
 import { webhookRoutes } from './webhook'
 import { uploadRoutes } from './upload'
 import { updateRoutes } from './update'
+import { authPublicRoutes, authProtectedRoutes } from './auth'
 
 // Hermes route modules
 import { sessionRoutes } from './hermes/sessions'
@@ -29,11 +30,13 @@ export function registerRoutes(app: any, requireAuth: (ctx: Context, next: Next)
   // --- Public routes (no auth required) ---
   app.use(healthRoutes.routes())
   app.use(webhookRoutes.routes())
+  app.use(authPublicRoutes.routes())
 
   // --- Auth middleware: all routes below require authentication ---
   app.use(requireAuth)
 
   // --- Protected routes (auth required) ---
+  app.use(authProtectedRoutes.routes())
   app.use(uploadRoutes.routes())
   app.use(updateRoutes.routes())           // Must be before proxy (proxy catch-all matches everything)
   app.use(sessionRoutes.routes())