更新管理员登录和鉴权逻辑，优化用户体验；重构相关API以支持更安全的身份验证；调整数据库初始化以兼容新字段，确保用户信息安全；修复部分组件样式和功能，提升整体可用性。

app/api/auth/login/route.ts

@@ -0,0 +1,73 @@
+/**
+ * Web 端登录：手机号 + 密码
+ * POST { phone, password } -> 校验后返回用户信息（不含密码）
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import { query } from '@/lib/db'
+import { verifyPassword } from '@/lib/password'
+
+function mapRowToUser(r: any) {
+  return {
+    id: r.id,
+    phone: r.phone || '',
+    nickname: r.nickname || '',
+    isAdmin: !!r.is_admin,
+    purchasedSections: Array.isArray(r.purchased_sections)
+      ? r.purchased_sections
+      : (r.purchased_sections ? JSON.parse(String(r.purchased_sections)) : []) || [],
+    hasFullBook: !!r.has_full_book,
+    referralCode: r.referral_code || '',
+    referredBy: r.referred_by || undefined,
+    earnings: parseFloat(String(r.earnings || 0)),
+    pendingEarnings: parseFloat(String(r.pending_earnings || 0)),
+    withdrawnEarnings: parseFloat(String(r.withdrawn_earnings || 0)),
+    referralCount: Number(r.referral_count) || 0,
+    createdAt: r.created_at || '',
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json()
+    const { phone, password } = body
+
+    if (!phone || !password) {
+      return NextResponse.json(
+        { success: false, error: '请输入手机号和密码' },
+        { status: 400 }
+      )
+    }
+
+    const rows = await query(
+      'SELECT id, phone, nickname, password, is_admin, has_full_book, referral_code, referred_by, earnings, pending_earnings, withdrawn_earnings, referral_count, purchased_sections, created_at FROM users WHERE phone = ?',
+      [String(phone).trim()]
+    ) as any[]
+
+    if (!rows || rows.length === 0) {
+      return NextResponse.json(
+        { success: false, error: '用户不存在或密码错误' },
+        { status: 401 }
+      )
+    }
+
+    const row = rows[0]
+    const storedPassword = row.password == null ? '' : String(row.password)
+
+    if (!verifyPassword(String(password), storedPassword)) {
+      return NextResponse.json(
+        { success: false, error: '密码错误' },
+        { status: 401 }
+      )
+    }
+
+    const user = mapRowToUser(row)
+    return NextResponse.json({ success: true, user })
+  } catch (e) {
+    console.error('[Auth Login] error:', e)
+    return NextResponse.json(
+      { success: false, error: '登录失败' },
+      { status: 500 }
+    )
+  }
+}

app/api/auth/reset-password/route.ts

@@ -0,0 +1,54 @@
+/**
+ * 忘记密码 / 重置密码（Web 端）
+ * POST { phone, newPassword } -> 按手机号更新密码（无验证码版本，适合内测/内部使用）
+ */
+
+import { NextRequest, NextResponse } from 'next/server'
+import { query } from '@/lib/db'
+import { hashPassword } from '@/lib/password'
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json()
+    const { phone, newPassword } = body
+
+    if (!phone || !newPassword) {
+      return NextResponse.json(
+        { success: false, error: '请输入手机号和新密码' },
+        { status: 400 }
+      )
+    }
+
+    const trimmedPhone = String(phone).trim()
+    const trimmedPassword = String(newPassword).trim()
+
+    if (trimmedPassword.length < 6) {
+      return NextResponse.json(
+        { success: false, error: '密码至少 6 位' },
+        { status: 400 }
+      )
+    }
+
+    const rows = await query('SELECT id FROM users WHERE phone = ?', [trimmedPhone]) as any[]
+    if (!rows || rows.length === 0) {
+      return NextResponse.json(
+        { success: false, error: '该手机号未注册' },
+        { status: 404 }
+      )
+    }
+
+    const hashed = hashPassword(trimmedPassword)
+    await query('UPDATE users SET password = ?, updated_at = NOW() WHERE phone = ?', [
+      hashed,
+      trimmedPhone,
+    ])
+
+    return NextResponse.json({ success: true, message: '密码已重置，请使用新密码登录' })
+  } catch (e) {
+    console.error('[Auth ResetPassword] error:', e)
+    return NextResponse.json(
+      { success: false, error: '重置失败' },
+      { status: 500 }
+    )
+  }
+}