Add secure administrator operations console

Provide TOTP-authenticated, role-controlled user and credit workflows with paginated audit data and SQL-backed statistics so operations can manage growth safely.

admin-web/src/test/format.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import {
+  escapeHtml,
+  formatDateTime,
+  formatSignedCredits,
+  statusLabel,
+} from "../lib/format";
+
+describe("format helpers", () => {
+  it("转义服务端文本以阻止 HTML 注入", () => {
+    expect(escapeHtml('<img src=x onerror="alert(1)">')).toBe(
+      "&lt;img src=x onerror=&quot;alert(1)&quot;&gt;",
+    );
+  });
+
+  it("无效日期显示占位符", () => {
+    expect(formatDateTime("not-a-date")).toBe("—");
+    expect(formatDateTime()).toBe("—");
+  });
+
+  it("积分变动保留明确正负号", () => {
+    expect(formatSignedCredits(15)).toBe("+15");
+    expect(formatSignedCredits(-8)).toBe("-8");
+  });
+
+  it("未知状态保持原值", () => {
+    expect(statusLabel("custom")).toBe("custom");
+  });
+});