feat: 侧边栏专属主页、邮箱认证、管理后台等多项功能

- 所有笔记/收藏/回收站各自展示专属主页（统计、列表、操作入口）
- 新增邮箱绑定、找回密码、个人中心功能
- 新增管理员路由与后台组件
- AI 模型设置、登录弹窗、侧边栏交互优化
- 修复懒加载、cloudEnabled 刷新、验证码冷却等 bug

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/middleware/auth.ts

@@ -1,5 +1,7 @@
 import { createMiddleware } from 'hono/factory'
 import jwt from 'jsonwebtoken'
+import { db, users } from '../db'
+import { eq } from 'drizzle-orm'
 
 export type JwtPayload = { userId: string; username: string }
 
@@ -25,3 +27,21 @@ export const requireAuth = createMiddleware(async (c, next) => {
     return c.json({ error: 'Token 无效或已过期' }, 401)
   }
 })
+
+export const requireAdmin = createMiddleware(async (c, next) => {
+  const header = c.req.header('Authorization')
+  if (!header?.startsWith('Bearer ')) {
+    return c.json({ error: '未登录' }, 401)
+  }
+  const token = header.slice(7)
+  try {
+    const payload = jwt.verify(token, process.env.JWT_SECRET!) as JwtPayload
+    const [user] = db.select({ role: users.role }).from(users).where(eq(users.id, payload.userId)).all()
+    if (!user || user.role !== 'admin') return c.json({ error: '权限不足' }, 403)
+    c.set('userId', payload.userId)
+    c.set('username', payload.username)
+    await next()
+  } catch {
+    return c.json({ error: 'Token 无效或已过期' }, 401)
+  }
+})