fix: 独立审计日志并补齐令牌身份与失败记录

internal/admin/auth.go

@@ -92,18 +92,18 @@ func (h *Handler) authenticate(r *http.Request, ip string) (principal, string, s
 	if strings.HasPrefix(strings.ToLower(authz), "bearer ") {
 		raw := strings.TrimSpace(authz[len("Bearer "):])
 		if raw == "" || !h.tokens.LooksLikeAPIToken(raw) {
-			return authFail(h, ip)
+			return h.authFail(ip)
 		}
 		hash := h.tokens.HashToken(raw)
 		info, err := h.lookupAPIToken(r.Context(), hash)
 		if err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
-				return authFail(h, ip)
+				return h.authFail(ip)
 			}
 			return principal{}, "internal", "内部错误", http.StatusInternalServerError
 		}
 		if !info.Enabled {
-			return authFail(h, ip)
+			return h.authFail(ip)
 		}
 		h.touchLastUsed(r.Context(), info.ID)
 		return principal{Kind: authToken, TokenName: info.Name, TokenID: info.ID}, "", "", 0
@@ -124,10 +124,12 @@ func (h *Handler) authenticate(r *http.Request, ip string) (principal, string, s
 	return principal{Kind: authCookie, Session: c.Value}, "", "", 0
 }
 
-func authFail(h *Handler, ip string) (principal, string, string, int) {
+func (h *Handler) authFail(ip string) (principal, string, string, int) {
 	if locked, _ := h.locks.Fail(auth.LockKey{Kind: auth.LockAdminIP, IP: ip}); locked {
+		h.auditAuthFail(ip, "rate_limited")
 		return principal{}, "rate_limited", "登录已锁定，请稍后再试", http.StatusTooManyRequests
 	}
+	h.auditAuthFail(ip, "invalid_token")
 	return principal{}, "unauthorized", "令牌无效", http.StatusUnauthorized
 }