refactor: 去掉 /api/v1/access/status，改为 401 触发登录页

[hjyssg]

Motivation

• 根据反馈移除多余的 GET /api/v1/access/status，简化启动探测逻辑。
• 前端不再在启动时探测状态，而改为任何接口返回 401 时直接进入登录流程以减少额外请求。

Description

• 后端：删除 GET /api/v1/access/status，在白名单中移除了 access/status 并保留 access/login，新增 POST /api/v1/access/login 登录接口与基于 Cookie 的简单认证 (shigureader_access)，并通过 onRequest 全局钩子在 ACCESS_PASSWORD 生效时对请求做 401 拦截（文件：backendnode/src/app.ts）。
• 后端：把 ACCESS_PASSWORD 配置项加入 backendnode/src/config.ts。
• 后端：新增依赖 @fastify/cookie 并更新 backendnode/package.json / package-lock.json 以支持 Cookie 操作。
• 前端：移除启动探测 access/status 的逻辑，改为在全局 fetch 包装器与 OpenAPI 响应拦截器中捕获 401（排除 /api/v1/access/login）并展示内置登录页；登录页提交到 POST /api/v1/access/login，登录成功后 window.location.reload()（文件：frontend/src/main.tsx）。
• 测试：新增集成测试覆盖访问保护行为（backendnode/tests/integration/api.integration.test.ts），包含未带 Cookie 被拒绝与登录后可访问两种场景。

Testing

• 已运行 npm --prefix backendnode run build，构建通过。
• 已运行 npm --prefix frontend run build，构建失败，原因为分支上已有的前端类型错误（qs 类型缺失 与 read 页面类型不匹配），与本次鉴权逻辑变更无直接关系。
• 新增的后端集成测试已提交，但未在当前环境完整运行（测试在某些环境依赖本地 SQLite 模块/环境限制），因此未在本次流水线中全部通过。

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 524d10b774

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow SPA static routes through access guard

When ACCESS_PASSWORD is set, the new onRequest guard rejects every path that is not explicitly exempted here, but the exemption list does not include / or static asset paths like /assets/*. In deployments where this backend serves the frontend bundle (configured later in this file), the initial HTML/JS requests are answered with 401 before the app can execute showLoginPage(), so users cannot reach the login UI at all and are effectively locked out.

Useful? React with 👍 / 👎.