feat(security): 操作审计日志 + 会话IP/UA绑定 + 敏感操作 step-up 2FA

应对管理员访问凭证失守导致的数据外泄风险，新增三层防护：

审计日志（admin-only 可见，用户不可见）
- 新增 append-only audit_logs 表（migration 180）+ 异步批量写入 + 保留期清理
- 审计中间件挂在 admin/user/auth/admin-payment 组认证之后：记录所有变更类
  请求 + 白名单敏感读取（账号/代理导出、备份下载、admin/user API key 读取）
- 请求头凭证首尾掩码；请求体 JSON 递归脱敏（api_key/password 等擦除，base_url
  保留以便追责）；非 JSON body 不入库
- 无单条删除；全量清空需现场 TOTP 校验、拒绝 admin API key、未启用 2FA 不允许，
  清空后同步写入留痕记录

会话 IP/UA 绑定（默认开启，可在系统设置关闭）
- JWT 携带 session id + IP/UA 指纹哈希；IP 或 UA 任一变化即撤销会话家族并要求
  重新登录；旧 token 无指纹时放行以平滑升级

敏感操作 step-up 2FA（sudo 窗口 15 分钟）
- 账号/代理导出、DB 备份创建/下载、S3 目标修改要求近期 TOTP 二次验证；admin API
  key 一律拒绝；前端 useStepUp 组合式 + TotpStepUpDialog 弹码后自动重试
- API key 查看按需求暂不加强管控

前端：新增 /admin/audit-logs 操作日志页面（筛选/详情/2FA 清空）、侧边栏入口、
step-up 弹窗接入导出与备份流程、安全设置项（绑定开关 + 日志保留天数）、zh/en i18n

frontend/src/api/admin/audit.ts

@@ -0,0 +1,82 @@
+/**
+ * Admin operation audit log API.
+ *
+ * The audit log is admin-only (not exposed to end users). It records
+ * management-plane operations with masked header credentials and redacted
+ * request bodies. Entries cannot be deleted individually; the whole log can
+ * only be cleared with a fresh TOTP verification.
+ */
+
+import { apiClient } from '../client'
+import type { PaginatedResponse } from '@/types'
+
+export interface AuditLog {
+  id: number
+  created_at: string
+  actor_user_id?: number
+  actor_email: string
+  actor_role: string
+  auth_method: string
+  credential_masked: string
+  action: string
+  method: string
+  path: string
+  request_id: string
+  client_ip: string
+  user_agent: string
+  request_body?: string
+  status_code: number
+  latency_ms: number
+  extra?: Record<string, any>
+}
+
+export interface AuditLogQuery {
+  page?: number
+  page_size?: number
+  start_time?: string
+  end_time?: string
+  actor_user_id?: number
+  actor_email?: string
+  auth_method?: string
+  action?: string
+  method?: string
+  client_ip?: string
+  success?: string
+  q?: string
+}
+
+export type AuditLogListResponse = PaginatedResponse<AuditLog>
+
+/**
+ * List audit logs (paginated, filterable).
+ */
+export async function list(params: AuditLogQuery): Promise<AuditLogListResponse> {
+  const { data } = await apiClient.get('/admin/audit-logs', { params })
+  return data
+}
+
+/**
+ * Get a single audit log entry (includes the redacted request body).
+ */
+export async function get(id: number): Promise<AuditLog> {
+  const { data } = await apiClient.get(`/admin/audit-logs/${id}`)
+  return data
+}
+
+/**
+ * Clear all audit logs. Requires a fresh TOTP code (verified server-side);
+ * unavailable when 2FA is not enabled for the operator.
+ * @param totpCode - current 6-digit TOTP code
+ */
+export async function clear(totpCode: string): Promise<{ deleted: number }> {
+  const { data } = await apiClient.post('/admin/audit-logs/clear', { totp_code: totpCode })
+  return data
+}
+
+export const auditAPI = {
+  list,
+  get,
+  clear
+}
+
+export default auditAPI

frontend/src/api/admin/index.ts

@@ -33,6 +33,7 @@ import adminPaymentAPI from './payment'
 import affiliatesAPI from './affiliates'
 import riskControlAPI from './riskControl'
 import adminComplianceAPI from './compliance'
+import auditAPI from './audit'
 
 /**
  * Unified admin API object for convenient access
@@ -67,7 +68,8 @@ export const adminAPI = {
   payment: adminPaymentAPI,
   affiliates: affiliatesAPI,
   riskControl: riskControlAPI,
-  compliance: adminComplianceAPI
+  compliance: adminComplianceAPI,
+  audit: auditAPI
 }
 
 export {
@@ -100,12 +102,14 @@ export {
   adminPaymentAPI,
   affiliatesAPI,
   riskControlAPI,
-  adminComplianceAPI
+  adminComplianceAPI,
+  auditAPI
 }
 
 export default adminAPI
 
 // Re-export types used by components
+export type { AuditLog, AuditLogQuery, AuditLogListResponse } from './audit'
 export type { BalanceHistoryItem } from './users'
 export type { ErrorPassthroughRule, CreateRuleRequest, UpdateRuleRequest } from './errorPassthrough'
 export type { BackupAgentHealth, DataManagementConfig } from './dataManagement'

frontend/src/api/admin/settings.ts

@@ -366,6 +366,8 @@ export interface SystemSettings {
   invitation_code_enabled: boolean;
   totp_enabled: boolean; // TOTP 双因素认证
   totp_encryption_key_configured: boolean; // TOTP 加密密钥是否已配置
+  session_binding_enabled: boolean; // 会话 IP/UA 绑定
+  audit_log_retention_days: number; // 审计日志保留天数
   login_agreement_enabled: boolean;
   login_agreement_mode: "modal" | "checkbox" | string;
   login_agreement_updated_at: string;
@@ -669,6 +671,8 @@ export interface UpdateSettingsRequest {
   frontend_url?: string;
   invitation_code_enabled?: boolean;
   totp_enabled?: boolean; // TOTP 双因素认证
+  session_binding_enabled?: boolean; // 会话 IP/UA 绑定
+  audit_log_retention_days?: number; // 审计日志保留天数
   login_agreement_enabled?: boolean;
   login_agreement_mode?: "modal" | "checkbox" | string;
   login_agreement_updated_at?: string;

frontend/src/api/totp.ts

@@ -71,13 +71,32 @@ export async function disable(request: TotpDisableRequest): Promise<{ success: b
   return data
 }
 
+/**
+ * Step-up verification response
+ */
+export interface TotpStepUpResponse {
+  verified: boolean
+  expires_in: number
+}
+
+/**
+ * Verify a TOTP code to grant the current session a short-lived step-up
+ * (sudo) window for sensitive operations (account export, DB backup download...).
+ * @param code - 6-digit TOTP code
+ */
+export async function stepUp(code: string): Promise<TotpStepUpResponse> {
+  const { data } = await apiClient.post<TotpStepUpResponse>('/user/totp/step-up', { code })
+  return data
+}
+
 export const totpAPI = {
   getStatus,
   getVerificationMethod,
   sendVerifyCode,
   initiateSetup,
   enable,
-  disable
+  disable,
+  stepUp
 }
 
 export default totpAPI