diff --git a/web/auth/login.html b/web/auth/login.html
new file mode 100644
index 0000000..c4ff7f0
--- /dev/null
+++ b/web/auth/login.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>iAOP 登录</title>
+  <link rel="stylesheet" href="auth.css">
+</head>
+<body>
+  <!--
+    iAOP 登录页（issue #150 / PRD 8.2）。
+    后端：core/auth/auth_api.py（POST /auth/login → token + Set-Cookie）。
+    会话：core/auth/session.py（HMAC token，HttpOnly cookie iaop_session）。
+    写操作守卫：core/auth/auth_api.py require_auth / can_write（未登录/readonly 拒绝写）。
+  -->
+  <form class="auth-card" id="loginForm" autocomplete="on" novalidate>
+    <div class="auth-brand">
+      <div class="auth-logo">iA</div>
+      <h1>云美工业AI优化平台</h1>
+    </div>
+    <div class="auth-sub">Template-Ti 一期 · 配置台登录</div>
+
+    <div class="alert" id="alert" role="alert" aria-live="polite"></div>
+
+    <div class="field">
+      <label for="username">用户名</label>
+      <input id="username" name="username" type="text" required
+             autocomplete="username" placeholder="请输入用户名" maxlength="64">
+    </div>
+    <div class="field">
+      <label for="password">密码</label>
+      <input id="password" name="password" type="password" required
+             autocomplete="current-password" placeholder="请输入密码" minlength="8">
+    </div>
+
+    <div class="auth-actions">
+      <button type="submit" class="btn btn-primary" id="loginBtn">登录</button>
+      <button type="button" class="btn btn-ghost" id="togglePwd" title="显示/隐藏密码" aria-label="显示或隐藏密码">👁</button>
+    </div>
+
+    <div class="role-hint">
+      角色：readonly 只读 / engineer 可配置 / admin 可发布回滚。<br>
+      未登录或只读角色不可执行写操作（PRD 8.2）。
+    </div>
+
+    <div class="auth-foot">
+      认证后端 core/auth · 会话 HttpOnly cookie · 密码 PBKDF2-HMAC-SHA256
+    </div>
+  </form>
+
+  <script src="auth.js"></script>
+</body>
+</html>
