feat: 完善分割工作区导入导出与管理流程

- 新增基于 JWT 当前用户的登录恢复、角色权限、用户管理、审计日志和演示出厂重置后台接口与前端管理页。

- 重串 GT_label 导出和 GT Mask 导入逻辑：导出保留类别真实 maskid，导入仅接受灰度或 RGB 等通道 maskid 图，支持未知 maskid 策略、尺寸最近邻拉伸和导入预览。

- 统一分割结果导出体验：默认当前帧，按项目抽帧顺序和 XhXXmXXsXXXms 时间戳命名 ZIP 与图片，补齐 GT/Pro/Mix/分开 Mask 输出和映射 JSON。

- 调整工作区左侧工具栏：移除创建点/线段入口，新增画笔、橡皮擦及尺寸控制，并按绘制、布尔、导入/AI 工具分组分隔。

- 扩展 Canvas 编辑能力：画笔按语义分类绘制并可自动并入连通选中 mask，橡皮擦对选中区域扣除，优化布尔操作、选区、撤销重做和保存状态联动。

- 优化自动传播时间轴显示：同一蓝色系按传播新旧递进变暗，老传播记录达到阈值后统一旧记录色，并维护范围选择与清空后的历史显示。

- 将 AI 智能分割入口替换为更明确的 AI 元素图标，并同步侧栏、工作区和 AI 页面入口表现。

- 完善模板分类、maskid 工具函数、分类树联动、遮罩透明度、边缘平滑和传播链同步相关前端状态。

- 扩展后端项目、媒体、任务、Dashboard、模板和传播 runner 的用户隔离、任务控制、进度事件与兼容处理。

- 补充前后端测试，覆盖用户管理、GT_label 往返导入导出、GT Mask 校验和预览、画笔/橡皮擦、时间轴传播历史、导出范围、WebSocket 与 API 封装。

- 更新 AGENTS、README 和 doc 文档，记录当前接口契约、实现状态、测试计划、安装说明和 maskid/GT_label 规则。

backend/main.py

@@ -20,7 +20,7 @@ from progress_events import PROGRESS_CHANNEL
 from redis_client import get_redis_client, ping as redis_ping
 from statuses import PROJECT_STATUS_PENDING, PROJECT_STATUS_READY
 
-from routers import projects, templates, media, ai, export, auth, dashboard, tasks
+from routers import projects, templates, media, ai, export, auth, dashboard, tasks, admin
 
 logging.basicConfig(
     level=logging.INFO,
@@ -28,7 +28,7 @@ logging.basicConfig(
 )
 logger = logging.getLogger(__name__)
 
-DEFAULT_VIDEO_PATH = "/home/wkmgc/Desktop/Seg_Server/Data_MyVideo_1.mp4"
+DEFAULT_VIDEO_PATH = settings.demo_video_path
 
 
 def _ensure_runtime_schema_columns() -> None:
@@ -36,25 +36,56 @@ def _ensure_runtime_schema_columns() -> None:
     try:
         inspector = inspect(engine)
         frame_columns = {column["name"] for column in inspector.get_columns("frames")}
+        project_columns = {column["name"] for column in inspector.get_columns("projects")}
+        template_columns = {column["name"] for column in inspector.get_columns("templates")}
         with engine.begin() as connection:
             if "timestamp_ms" not in frame_columns:
                 connection.execute(text("ALTER TABLE frames ADD COLUMN timestamp_ms FLOAT"))
             if "source_frame_number" not in frame_columns:
                 connection.execute(text("ALTER TABLE frames ADD COLUMN source_frame_number INTEGER"))
+            if "owner_user_id" not in project_columns:
+                connection.execute(text("ALTER TABLE projects ADD COLUMN owner_user_id INTEGER"))
+            if "owner_user_id" not in template_columns:
+                connection.execute(text("ALTER TABLE templates ADD COLUMN owner_user_id INTEGER"))
     except Exception as exc:  # noqa: BLE001
         logger.warning("Runtime schema column check failed: %s", exc)
 
 
+def _seed_default_admin_and_ownership_sync() -> None:
+    """Ensure the default admin exists and owns legacy unassigned projects."""
+    from models import Project
+    from routers.auth import ensure_default_admin
+
+    db = SessionLocal()
+    try:
+        admin = ensure_default_admin(db)
+        db.query(Project).filter(Project.owner_user_id.is_(None)).update(
+            {"owner_user_id": admin.id},
+            synchronize_session=False,
+        )
+        db.commit()
+        logger.info("Default admin ready; legacy projects assigned to user id=%s", admin.id)
+    except Exception as exc:  # noqa: BLE001
+        logger.error("Failed to seed default admin or ownership: %s", exc)
+    finally:
+        db.close()
+
+
 def _seed_default_project_sync() -> None:
     """Synchronously seed the default video project on first startup."""
     import cv2
     from models import Project, Frame
+    from routers.auth import ensure_default_admin
     from services.frame_parser import parse_video, upload_frames_to_minio, extract_thumbnail
 
     db = SessionLocal()
     try:
+        admin = ensure_default_admin(db)
         existing = db.query(Project).filter(Project.name == "Data_MyVideo_1").first()
         if existing is not None:
+            if existing.owner_user_id is None:
+                existing.owner_user_id = admin.id
+                db.commit()
             return
 
         if not os.path.exists(DEFAULT_VIDEO_PATH):
@@ -67,6 +98,7 @@ def _seed_default_project_sync() -> None:
             status=PROJECT_STATUS_PENDING,
             source_type="video",
             parse_fps=30.0,
+            owner_user_id=admin.id,
         )
         db.add(project)
         db.commit()
@@ -196,6 +228,7 @@ async def lifespan(app: FastAPI):
     try:
         Base.metadata.create_all(bind=engine)
         _ensure_runtime_schema_columns()
+        _seed_default_admin_and_ownership_sync()
         logger.info("Database tables initialized.")
     except Exception as exc:  # noqa: BLE001
         logger.error("Database initialization failed: %s", exc)
@@ -265,6 +298,7 @@ app.include_router(ai.router)
 app.include_router(export.router)
 app.include_router(dashboard.router)
 app.include_router(tasks.router)
+app.include_router(admin.router)
 
 
 @app.get("/health", tags=["Health"])