feat: 完成 issue #134 登录认证+用户/角色管理（web/auth，RBAC 三级，OIDC 预留，接入配置台）

web/studio/studio.js

@@ -458,6 +458,7 @@ function publish() {
     changelog: "发布模板资产包", snapshot: currentSnapshot()
   });
   store("studio.releases.v1", studioState.releases);
+  if (typeof Auth !== "undefined") Auth.audit("publish", "release", version); // #134 写操作审计
   renderVersions();
 }
 
@@ -480,6 +481,7 @@ function rollbackTo(index) {
     changelog: "回滚自 " + target.version, snapshot: currentSnapshot()
   });
   store("studio.releases.v1", studioState.releases);
+  if (typeof Auth !== "undefined") Auth.audit("rollback", "release", "回滚自 " + target.version);
   renderVersions(); renderCanvas(); renderHyperForm();
 }
 
@@ -543,6 +545,26 @@ var studioState = {
 function persistConfig() { store("studio.config.v1", studioState.config); }
 
 (function init() {
+  // 认证门控（issue #134）：从 web/ 根目录起服务时加载 ../auth/auth.js，
+  // 未登录跳登录页；登录后角色以会话为准（角色下拉锁定）。
+  // auth.js 缺失（独立起服务于 web/studio）时降级为手动角色切换演示。
+  if (typeof Auth !== "undefined") {
+    var session = Auth.requireAuth("../auth/login.html");
+    if (!session) return; // 正在跳转登录页
+    currentRole = session.role;
+    var roleSelect = document.getElementById("role-select");
+    roleSelect.value = session.role;
+    roleSelect.disabled = true;
+    document.getElementById("role-hint").textContent =
+      session.username + " · " + RBAC[currentRole].label +
+      (Auth.can(session.role, "manage") ? " · 用户管理 →" : "");
+    if (Auth.can(session.role, "manage")) {
+      document.getElementById("role-hint").style.cursor = "pointer";
+      document.getElementById("role-hint").onclick = function () {
+        location.href = "../auth/users.html";
+      };
+    }
+  }
   // 页签切换
   document.querySelectorAll(".tab").forEach(function (tab) {
     tab.onclick = function () {