diff --git a/index.html b/index.html
index 3d51a17..7b7537b 100644
--- a/index.html
+++ b/index.html
@@ -9,23 +9,30 @@
 </style>
 </head>
 <body><div id="loginOverlay" class="login-overlay"><form id="loginForm" class="login-box"><h2>AM Downloader</h2><p>登录后管理你的下载任务、积分和同步设置。</p><div class="field"><label>用户名</label><input id="loginUser" class="input" autocomplete="username"></div><div class="field"><label>密码</label><input id="loginPass" type="password" class="input" autocomplete="current-password"></div><div id="loginError" class="login-error"></div><button class="btn" style="width:100%;margin-top:10px">登录</button></form></div><div class="wrap">
-<header class="top"><div><div class="brand">AM <b>Downloader</b></div><div class="sub">搜索 · 下载 · WebDAV 同步</div></div><nav class="nav" id="topNav"><button data-view="home">首页</button><button data-view="search">搜索</button><button data-view="queue">下载<span id="navBadge" class="badge">0</span></button><button data-view="settings">设置</button></nav></header><div class="authbar"><span id="userPill" class="userpill"></span><button id="logoutBtn" class="btn alt">退出</button></div>
+<header class="top"><div><div class="brand">AM <b>Downloader</b></div><div class="sub">搜索 · 下载 · WebDAV 同步</div></div><nav class="nav" id="topNav"><button data-view="home">首页</button><button data-view="search">搜索</button><button data-view="queue">下载<span id="navBadge" class="badge">0</span></button><button data-view="account">账户</button><button id="adminNav" data-view="admin">管理</button><button data-view="settings">设置</button></nav></header><div class="authbar"><span id="userPill" class="userpill"></span><button id="logoutBtn" class="btn alt">退出</button></div>
 <main>
 <section id="home" class="view"><div class="hero"><h1>找到你想听的音乐</h1><p>搜索歌曲、歌手或专辑，加入下载队列即可。</p><form id="homeSearch" class="searchbar"><input id="homeKeyword" class="input" placeholder="输入歌曲名、歌手或专辑" autocomplete="off"><select id="homeSource" class="input"><option value="kw">小窝</option><option value="kg">小狗</option><option value="wy">小云</option><option value="tx">小Q</option></select><button class="btn">开始搜索</button></form></div><div class="card"><div class="section-head"><div class="title">最近下载</div><button class="btn alt" data-go="queue">查看全部</button></div><div id="recentTasks"></div></div></section>
 <section id="search" class="view"><div class="card"><div class="section-head"><div><div class="title">搜索音乐</div><div class="muted">支持歌曲名、歌手、专辑</div></div></div><form id="searchForm" class="row"><input id="keyword" class="input" placeholder="输入关键词" autocomplete="off"><select id="source" class="input"><option value="kw">小窝</option><option value="kg">小狗</option><option value="wy">小云</option><option value="tx">小Q</option></select><button class="btn">搜索</button></form></div><div id="resultsCard" class="card" style="display:none"><div class="section-head"><div><div class="title">搜索结果</div><div id="resultHint" class="muted"></div></div></div><div id="results" class="results"></div><button id="loadMore" class="btn alt loadmore" style="display:none">加载更多</button></div></section>
 <section id="queue" class="view"><div class="card"><div class="section-head"><div><div class="title">下载队列</div><div class="muted">任务会自动处理；本地文件是否保留由“设置 → 下载 → 本地文件策略”决定。</div></div></div><div id="taskTabs" class="task-tabs"><button class="active" data-filter="all">全部</button><button data-filter="active">进行中</button><button data-filter="done">已完成</button><button data-filter="error">失败</button></div><div id="tasks"></div></div></section>
+<section id="account" class="view"><div class="settings-grid"><div class="card setting-card"><h3>账户与积分</h3><p>积分用于新的实际下载；失败会自动退回。</p><div class="notice" id="creditPanel">加载中…</div><div class="field"><label>兑换码</label><input id="redeemCode" class="input" placeholder="XXXX-XXXX-XXXX"><button id="redeemBtn" class="btn" style="margin-top:9px">兑换积分</button></div></div><div id="userDavCard" class="card setting-card"><h3>我的 WebDAV</h3><p>仅 privileged / admin 可配置。密码不会回显。</p><div class="field"><label>地址</label><input id="userDavUrl" class="input"></div><div class="row"><input id="userDavUser" class="input" placeholder="用户名"><input id="userDavPass" type="password" class="input" placeholder="新密码（留空不修改）"></div><div class="field"><label>根目录</label><input id="userDavRoot" class="input" placeholder="Music"></div><div class="row" style="margin-top:12px"><button id="testUserDav" class="btn alt">测试</button><button id="saveUserDav" class="btn">保存</button></div></div></div></section>
+<section id="admin" class="view"><div class="card"><div class="section-head"><div><div class="title">用户管理</div><div class="muted">创建账号、分配角色、启用或禁用。</div></div></div><div class="row"><input id="newUser" class="input" placeholder="用户名"><input id="newPass" type="password" class="input" placeholder="初始密码（8+）"><select id="newRole" class="input"><option value="user">user</option><option value="privileged">privileged</option><option value="admin">admin</option></select><input id="newCredits" class="input" type="number" min="0" value="0" placeholder="积分"><button id="createUser" class="btn">创建</button></div><div id="users" style="margin-top:14px"></div></div><div class="card"><div class="section-head"><div><div class="title">兑换码批次</div><div class="muted">生成后明文兑换码仅在创建结果中返回。</div></div></div><div class="row"><input id="batchCredits" class="input" type="number" min="1" value="10" placeholder="每码积分"><input id="batchCount" class="input" type="number" min="1" max="10000" value="10" placeholder="数量"><input id="batchNote" class="input" placeholder="备注"><button id="createBatch" class="btn">生成兑换码</button></div><pre id="batchOutput" class="notice" style="white-space:pre-wrap;max-height:220px;overflow:auto"></pre><div id="batches"></div></div><div class="card"><div class="section-head"><div class="title">审计日志</div><button id="loadAudit" class="btn alt">刷新</button></div><div id="audit" class="muted"></div></div></section>
 <section id="settings" class="view"><div class="settings-grid"><div class="card setting-card"><h3>音乐 API</h3><p>用于搜索和解析音乐资源，与 Downloader Web 服务分离。</p><div class="field"><label>API 地址</label><input id="amApi" class="input" placeholder="http://127.0.0.1:9530"></div><div class="notice">当前服务架构：Downloader Web 使用 9540，音乐 API 使用 9530。</div></div><div class="card setting-card"><h3>下载</h3><p>设置文件保存位置与默认音质。</p><div class="field"><label>本地下载目录</label><input id="downloadDir" class="input"></div><div class="field"><label>本地文件策略</label><select id="localFilePolicy" class="input"><option value="keep">保留本地文件</option><option value="delete_after_upload">WebDAV 上传成功后删除本地文件</option></select><div class="notice">仅在 WebDAV 上传成功或远端已存在相同大小文件后删除本地成品；上传失败不会删除。</div></div><div class="field"><label>默认下载品质</label><select id="defaultQuality" class="input"><option value="standard">标准</option><option value="exhigh">高品质</option><option value="lossless">无损</option><option value="hires">Hi-Res</option><option value="sky">Sky</option><option value="jyeffect">高清音效</option><option value="jymaster">母带</option><option value="atmos">Atmos</option><option value="atmos_plus">Atmos+</option><option value="master">Master</option></select></div></div><div class="card setting-card"><h3>WebDAV</h3><p>可选的 NAS/远程音乐库同步配置。</p><div class="field"><label>WebDAV 地址</label><input id="davUrl" class="input" placeholder="https://nas.example.com/dav/music"></div><div class="row"><div class="field"><label>用户名</label><input id="davUser" class="input"></div><div class="field"><label>密码</label><input id="davPass" type="password" class="input"></div></div><div class="field"><label>远程音乐目录</label><input id="davPath" class="input" placeholder="Music"></div><div class="field"><label>同曲不同音质</label><select id="davVersionPolicy" class="input"><option value="keep">保留所有版本</option><option value="replace_lower">高音质下载后清理旧低音质</option></select><div class="notice">“清理旧低音质”只删除数据库中已确认属于同一首歌、且音质低于当前版本的旧 WebDAV 文件，不会扫描或删除未知文件。</div></div><div class="row" style="margin-top:15px"><button id="testDav" type="button" class="btn alt">测试连接</button><button id="saveSettings" type="button" class="btn">保存设置</button></div></div></div></section>
-</main><nav class="mobile-nav" id="mobileNav"><button data-view="home">⌂<br>首页</button><button data-view="search">⌕<br>搜索</button><button data-view="queue">♫ <span id="mobileBadge">0</span><br>下载</button><button data-view="settings">⚙<br>设置</button></nav></div>
+</main><nav class="mobile-nav" id="mobileNav"><button data-view="home">⌂<br>首页</button><button data-view="search">⌕<br>搜索</button><button data-view="queue">♫ <span id="mobileBadge">0</span><br>下载</button><button data-view="account">◎<br>账户</button><button data-view="settings">⚙<br>设置</button></nav></div>
 <script>
 const $=id=>document.getElementById(id);let searchPage=1,searchKeyword='',searchSource='kw',searchLoading=false,hasMore=false,taskFilter='all';
 async function api(u,o){const r=await fetch('/api'+u,o);if(r.status===401){showLogin();throw new Error('请先登录')}if(!r.ok)throw new Error(await r.text());return r.status===204?null:r.json()}
 function showLogin(){document.getElementById('loginOverlay').style.display='flex'}
+async function loadAccount(){try{const c=await api('/credits');$('creditPanel').textContent='余额 '+c.balance+' · 预留 '+c.reserved+' · 可用 '+c.available;const u=window.currentUser||{};$('userDavCard').style.display=(u.role==='admin'||u.role==='privileged')?'':'none';if(u.role==='admin'||u.role==='privileged'){const d=await api('/webdav/config');$('userDavUrl').value=d.url||'';$('userDavUser').value=d.username||'';$('userDavRoot').value=d.rootPath||''}}catch(e){$('creditPanel').textContent=e.message}}
+async function loadAdmin(){if(!window.isAdmin)return;try{const x=await api('/admin/users');$('users').innerHTML=(x.data||[]).map(u=>{const next=u.status==='active'?'disabled':'active';return '<div class="result"><div><div class="name">'+esc(u.username)+'</div><div class="meta">#'+u.id+' · '+esc(u.role)+' · '+esc(u.status)+'</div></div><div class="toolbar"><button class="btn alt" onclick="toggleUser('+u.id+',\''+next+'\')">'+(u.status==='active'?'禁用':'启用')+'</button></div></div>'}).join('')||'<div class="empty">暂无用户</div>';const b=await api('/admin/redeem');$('batches').innerHTML=(b.data||[]).map(x=>'<div class="notice">#'+x.id+' · '+x.credits+' 积分 × '+x.count+(x.note?' · '+esc(x.note):'')+' <button class="btn alt" onclick="revokeBatch('+x.id+')">撤销未使用</button></div>').join('');const l=await api('/admin/audit');$('audit').innerHTML=(l.data||[]).map(x=>'<div class="notice">'+esc(x.action)+' · '+esc(x.targetType)+'#'+esc(x.targetId)+' · '+esc(x.metadata||'')+' · '+esc(x.createdAt)+'</div>').join('')||'暂无日志'}catch(e){$('users').textContent=e.message}}
+async function toggleUser(id,status){await api('/admin/users/'+id,{method:'PUT',headers:{'Content-Type':'application/json'},body:JSON.stringify({status})});loadAdmin()}
+async function revokeBatch(id){await api('/admin/redeem/'+id+'/revoke',{method:'POST'});loadAdmin()}
+
 function hideLogin(){document.getElementById('loginOverlay').style.display='none'}
-async function initAuth(){try{const x=await api('/auth/me');const u=x.user;document.getElementById('userPill').textContent=u.username+' · '+u.role;document.getElementById('settings').style.display=u.role==='admin'?'':'none';document.querySelectorAll('[data-view=\"settings\"]').forEach(x=>x.style.display=u.role==='admin'?'':'none');const c=await api('/credits');document.getElementById('userPill').textContent=u.username+' · '+u.role+' · 积分 '+c.balance+' / 可用 '+c.available;hideLogin();return true}catch(e){showLogin();return false}}
-$('loginForm').addEventListener('submit',async e=>{e.preventDefault();$('loginError').textContent='登录中…';try{const x=await fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:$('loginUser').value.trim(),password:$('loginPass').value})});if(!x.ok)throw new Error('用户名或密码错误');await initAuth();go(location.hash.slice(1)||'home');loadRecent()}catch(e){$('loginError').textContent=e.message}});
+async function initAuth(){try{const x=await api('/auth/me');const u=x.user;window.currentUser=u;window.isAdmin=u.role==='admin';document.getElementById('userPill').textContent=u.username+' · '+u.role;document.getElementById('settings').style.display=u.role==='admin'?'':'none';document.getElementById('adminNav').style.display=u.role==='admin'?'':'none';document.querySelectorAll('[data-view=\"settings\"]').forEach(x=>x.style.display=u.role==='admin'?'':'none');const c=await api('/credits');document.getElementById('userPill').textContent=u.username+' · '+u.role+' · 积分 '+c.balance+' / 可用 '+c.available;hideLogin();return true}catch(e){showLogin();return false}}
+$('loginForm').addEventListener('submit',async e=>{e.preventDefault();$('loginError').textContent='登录中…';try{const x=await fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:$('loginUser').value.trim(),password:$('loginPass').value})});if(!x.ok)throw new Error('用户名或密码错误');await initAuth();go(location.hash.slice(1)||'home');loadRecent();loadAccount()}catch(e){$('loginError').textContent=e.message}});
 $('logoutBtn').addEventListener('click',async()=>{try{await api('/auth/logout',{method:'POST'})}finally{showLogin()}});
 function esc(s){return String(s??'').replace(/[&<>"']/g,m=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[m]))}
-function go(view){document.querySelectorAll('.view').forEach(x=>x.classList.toggle('active',x.id===view));document.querySelectorAll('[data-view]').forEach(x=>x.classList.toggle('active',x.dataset.view===view));if(view==='settings')loadSettings();if(view==='queue')loadTasks();if(view==='home')loadRecent();history.replaceState(null,'','#'+view)}
+function go(view){if(view==='admin' && !window.isAdmin){view='home'}document.querySelectorAll('.view').forEach(x=>x.classList.toggle('active',x.id===view));document.querySelectorAll('[data-view]').forEach(x=>x.classList.toggle('active',x.dataset.view===view));if(view==='settings')loadSettings();if(view==='account')loadAccount();if(view==='admin')loadAdmin();if(view==='queue')loadTasks();if(view==='home')loadRecent();history.replaceState(null,'','#'+view)}
 document.querySelectorAll('[data-view]').forEach(b=>b.addEventListener('click',()=>go(b.dataset.view)));document.querySelectorAll('[data-go]').forEach(b=>b.addEventListener('click',()=>go(b.dataset.go)));
 function qualityRank(q){return {standard:1,exhigh:2,sq:3,lossless:4,hires:5,jyeffect:6,sky:7,jymaster:8,atmos:9,atmos_plus:10,master:11}[q]||0}
 function qualityName(q){return {standard:'标准',exhigh:'高品质',sq:'SQ',lossless:'无损',hires:'Hi-Res',jyeffect:'高清音效',sky:'Sky',jymaster:'母带',atmos:'Atmos',atmos_plus:'Atmos+',master:'Master'}[q]||q}
@@ -41,5 +48,11 @@ document.querySelectorAll('#taskTabs button').forEach(b=>b.addEventListener('cli
 async function loadSettings(){try{const s=await api('/admin/settings');$('amApi').value=s.amApi||'';$('downloadDir').value=s.downloadDir||'';$('localFilePolicy').value=s.localFilePolicy||'keep';$('davUrl').value=s.webdavUrl||'';$('davUser').value=s.webdavUser||'';$('davPass').value=s.webdavPass||'';$('davPath').value=s.webdavPath||'';$('defaultQuality').value=s.quality||'standard';$('davVersionPolicy').value=s.webdavVersionPolicy||'keep'}catch(e){alert('设置加载失败：'+e.message)}}
 $('saveSettings').addEventListener('click',async()=>{const b={amApi:$('amApi').value,downloadDir:$('downloadDir').value,localFilePolicy:$('localFilePolicy').value,webdavUrl:$('davUrl').value,webdavUser:$('davUser').value,webdavPass:$('davPass').value,webdavPath:$('davPath').value,quality:$('defaultQuality').value,webdavVersionPolicy:$('davVersionPolicy').value};try{await api('/admin/settings',{method:'PUT',headers:{'Content-Type':'application/json'},body:JSON.stringify(b)});alert('设置已保存')}catch(e){alert('保存失败：'+e.message)}});
 $('testDav').addEventListener('click',async()=>{try{const b={url:$('davUrl').value,user:$('davUser').value,pass:$('davPass').value,path:$('davPath').value};await api('/admin/webdav/test',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(b)});alert('WebDAV 连接成功')}catch(e){alert('WebDAV 连接失败：'+e.message)}});
-initAuth().then(ok=>{if(ok){go(location.hash.slice(1)||'home');loadRecent()}});setInterval(()=>{loadTasks();if(document.getElementById('home').classList.contains('active'))loadRecent()},3000);
+$('redeemBtn').addEventListener('click',async()=>{try{const x=await api('/redeem',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({code:$('redeemCode').value})});alert('兑换成功：+'+x.credits+' 积分');$('redeemCode').value='';loadAccount()}catch(e){alert('兑换失败：'+e.message)}});
+$('saveUserDav').addEventListener('click',async()=>{try{await api('/webdav/config',{method:'PUT',headers:{'Content-Type':'application/json'},body:JSON.stringify({enabled:true,url:$('userDavUrl').value,username:$('userDavUser').value,password:$('userDavPass').value,rootPath:$('userDavRoot').value})});alert('WebDAV 已保存')}catch(e){alert('保存失败：'+e.message)}});
+$('testUserDav').addEventListener('click',async()=>{try{await api('/webdav/test',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({url:$('userDavUrl').value,username:$('userDavUser').value,password:$('userDavPass').value,rootPath:$('userDavRoot').value})});alert('连接成功')}catch(e){alert('连接失败：'+e.message)}});
+$('createUser').addEventListener('click',async()=>{try{await api('/admin/users',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:$('newUser').value,password:$('newPass').value,role:$('newRole').value,credits:Number($('newCredits').value||0)})});$('newUser').value='';$('newPass').value='';loadAdmin()}catch(e){alert('创建失败：'+e.message)}});
+$('createBatch').addEventListener('click',async()=>{try{const x=await api('/admin/redeem',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({credits:Number($('batchCredits').value),count:Number($('batchCount').value),note:$('batchNote').value})});$('batchOutput').textContent=x.codes.join('\n');loadAdmin()}catch(e){alert('生成失败：'+e.message)}});
+$('loadAudit').addEventListener('click',loadAdmin);
+initAuth().then(ok=>{if(ok){go(location.hash.slice(1)||'home');loadRecent();loadAccount()}});setInterval(()=>{loadTasks();if(document.getElementById('home').classList.contains('active'))loadRecent()},3000);
 </script></body></html>