feat: implement frontend-backend encrypted communication via AES-256-GCM

参考 novavis-authority 的加解密方案，实现前后端通信的应用层加密：
- 重写 src/lib/crypto.ts 使用 Web Crypto API（浏览器兼容），PBKDF2+AES-256-GCM
- 新增 src/lib/crypto-server.ts 服务端加解密工具（Node.js crypto）
- 新增 src/lib/api-crypto.ts API 路由中间件 withCrypto()，自动解密请求体/加密响应体
- 更新 src/lib/admin-api.ts 自动加密所有请求/解密响应
- 所有 11 个 admin API 路由文件已应用 withCrypto 包装器
- 更新 .env 文件，添加 NEXT_PUBLIC_ENCRYPTION_SECRET 和 ENCRYPTION_SECRET

src/app/api/admin/users/route.ts

@@ -2,9 +2,10 @@ import { NextRequest } from 'next/server';
 import { prisma } from '@/lib/db';
 import { authenticateRequest, hashPassword } from '@/lib/auth';
 import { success, unauthorized, forbidden, internalError, validationError } from '@/lib/api-response';
+import { withCrypto } from '@/lib/api-crypto';
 
 // GET /api/admin/users - 获取用户列表
-export async function GET(request: NextRequest) {
+export const GET = withCrypto(async (request: NextRequest) => {
   const user = authenticateRequest(request);
   if (!user) return unauthorized();
 
@@ -77,10 +78,10 @@ export async function GET(request: NextRequest) {
     console.error('Get users error:', error);
     return internalError();
   }
-}
+});
 
 // POST /api/admin/users - 创建用户
-export async function POST(request: NextRequest) {
+export const POST = withCrypto(async (request: NextRequest) => {
   const user = authenticateRequest(request);
   if (!user) return unauthorized();
 
@@ -153,10 +154,10 @@ export async function POST(request: NextRequest) {
     console.error('Create user error:', error);
     return internalError();
   }
-}
+});
 
 // PUT /api/admin/users - 更新用户
-export async function PUT(request: NextRequest) {
+export const PUT = withCrypto(async (request: NextRequest) => {
   const currentUser = authenticateRequest(request);
   if (!currentUser) return unauthorized();
 
@@ -220,10 +221,10 @@ export async function PUT(request: NextRequest) {
     console.error('Update user error:', error);
     return internalError();
   }
-}
+});
 
 // DELETE /api/admin/users - 删除用户
-export async function DELETE(request: NextRequest) {
+export const DELETE = withCrypto(async (request: NextRequest) => {
   const currentUser = authenticateRequest(request);
   if (!currentUser) return unauthorized();
 
@@ -260,4 +261,4 @@ export async function DELETE(request: NextRequest) {
     console.error('Delete user error:', error);
     return internalError();
   }
-}
+});