merge: integrate latest qyqy_develop (auth login + RBAC read) into ZSY branch

Incremental merge on top of ef701c8, which already integrated the earlier qyqy base bbf623a. qyqy_develop only added commits on top of bbf623a, so this merge is conflict-free. Incoming: account/password login (POST /api/v1/auth/tokens), RBAC read-only query API, rate limit dependency, login test console and user management tools. Additive changes in app/main.py, requirements.txt and pyproject.toml from both sides are all preserved. ZSY side capabilities (visitor tokens, customer service agent, knowledge retrieval, profile projection) are unchanged.

docs/evidence/auth-state.json

@@ -0,0 +1,27 @@
+{
+  "user_count": 5,
+  "by_status": {
+    "正常": 4,
+    "禁用": 1
+  },
+  "by_user_type": {
+    "employee": 3,
+    "customer": 1,
+    "员工": 1
+  },
+  "password_hash_shape": {
+    "length_distribution": {
+      "1": 4,
+      "31": 1
+    },
+    "prefix_distribution": {
+      "<未知格式，首字符 'x'>": 4,
+      "<未知格式，首字符 '!'>": 1
+    }
+  },
+  "has_real_password_hash": false,
+  "placeholder_examples": [
+    "!worker-only-no-password-login!",
+    "x"
+  ]
+}