feat(admin): 后台新增条目与分组 CRUD

- POST /api/items + DELETE /api/items/{key}：新增应用/海报/图文，按分区/分组挂载；PATCH 支持 nodeKey 移动
- 分组 CRUD：POST /api/categories/{id}/groups、PATCH/DELETE /api/groups/{id}（删除级联组内条目）
- PATCH /api/categories/{id} 增加 blockNodeKey，首页卡片可选择预览分组
- /admin 新增「内容」Tab（新增/删除条目），「分区」Tab 内联分组管理与卡片预览
- 测试 59 passed（条目创建/移动/删除、分组增删改）

src/server.rs

@@ -718,6 +718,58 @@ async fn post_like(
     }
 }
 
+/// POST /api/items —— 新建条目（需要登录）
+async fn create_item(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(body): Json<crate::db::entries::NewEntry>,
+) -> Response {
+    if !same_origin(&headers) {
+        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
+    }
+    match read_session(&state, &headers).await {
+        Ok(session) if session.authenticated => {}
+        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
+        Err(response) => return response,
+    }
+
+    let db = Arc::clone(&state.db);
+    match tokio::task::spawn_blocking(move || db.create_entry(body)).await {
+        Ok(Ok(entry)) => Json(entry).into_response(),
+        Ok(Err(StashError::Conflict(message))) => api_error(StatusCode::CONFLICT, &message),
+        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
+        Ok(Err(StashError::InvalidDirectory(message))) => {
+            api_error(StatusCode::BAD_REQUEST, &message)
+        }
+        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+    }
+}
+
+/// DELETE /api/items/{key} —— 删除条目（需要登录）
+async fn delete_item(
+    State(state): State<AppState>,
+    Path(key): Path<String>,
+    headers: HeaderMap,
+) -> Response {
+    if !same_origin(&headers) {
+        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
+    }
+    match read_session(&state, &headers).await {
+        Ok(session) if session.authenticated => {}
+        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
+        Err(response) => return response,
+    }
+
+    let db = Arc::clone(&state.db);
+    match tokio::task::spawn_blocking(move || db.remove_entry(&key)).await {
+        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
+        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
+        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+    }
+}
+
 /// POST /api/categories —— 新建分区（需要登录）
 async fn create_category(
     State(state): State<AppState>,
@@ -773,6 +825,90 @@ async fn update_category(
     }
 }
 
+/// POST /api/categories/{id}/groups —— 新建分组（需要登录）
+async fn create_group(
+    State(state): State<AppState>,
+    Path(section_id): Path<String>,
+    headers: HeaderMap,
+    Json(body): Json<crate::db::categories::NewGroup>,
+) -> Response {
+    if !same_origin(&headers) {
+        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
+    }
+    match read_session(&state, &headers).await {
+        Ok(session) if session.authenticated => {}
+        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
+        Err(response) => return response,
+    }
+
+    let db = Arc::clone(&state.db);
+    match tokio::task::spawn_blocking(move || db.create_group(&section_id, body)).await {
+        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
+        Ok(Err(StashError::Conflict(message))) => api_error(StatusCode::CONFLICT, &message),
+        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
+        Ok(Err(StashError::InvalidDirectory(message))) => {
+            api_error(StatusCode::BAD_REQUEST, &message)
+        }
+        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+    }
+}
+
+/// PATCH /api/groups/{id} —— 分组改名 / 显隐（需要登录）
+async fn update_group(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: HeaderMap,
+    Json(body): Json<crate::db::categories::UpdateGroup>,
+) -> Response {
+    if !same_origin(&headers) {
+        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
+    }
+    match read_session(&state, &headers).await {
+        Ok(session) if session.authenticated => {}
+        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
+        Err(response) => return response,
+    }
+
+    let db = Arc::clone(&state.db);
+    match tokio::task::spawn_blocking(move || db.update_group(&id, body)).await {
+        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
+        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
+        Ok(Err(StashError::InvalidDirectory(message))) => {
+            api_error(StatusCode::BAD_REQUEST, &message)
+        }
+        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+    }
+}
+
+/// DELETE /api/groups/{id} —— 删除分组（需要登录，组内条目级联删除）
+async fn delete_group(
+    State(state): State<AppState>,
+    Path(id): Path<String>,
+    headers: HeaderMap,
+) -> Response {
+    if !same_origin(&headers) {
+        return api_error(StatusCode::FORBIDDEN, "跨站请求被拒绝");
+    }
+    match read_session(&state, &headers).await {
+        Ok(session) if session.authenticated => {}
+        Ok(_) => return api_error(StatusCode::UNAUTHORIZED, "请先登录"),
+        Err(response) => return response,
+    }
+
+    let db = Arc::clone(&state.db);
+    match tokio::task::spawn_blocking(move || db.remove_group(&id)).await {
+        Ok(Ok(())) => Json(serde_json::json!({ "ok": true })).into_response(),
+        Ok(Err(StashError::NotFound(message))) => api_error(StatusCode::NOT_FOUND, &message),
+        Ok(Err(StashError::InvalidDirectory(message))) => {
+            api_error(StatusCode::BAD_REQUEST, &message)
+        }
+        Ok(Err(error)) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+        Err(error) => api_error(StatusCode::INTERNAL_SERVER_ERROR, &error.to_string()),
+    }
+}
+
 /// DELETE /api/categories/{id} —— 删除分区（需要登录，级联内容）
 async fn delete_category(
     State(state): State<AppState>,
@@ -826,7 +962,8 @@ fn build_router(state: AppState) -> Router {
         .route("/api/auth/logout", post(auth_logout))
         .route("/api/auth/password", patch(auth_password))
         .route("/api/settings", get(get_settings).patch(patch_settings))
-        .route("/api/items/{key}", get(get_item).patch(patch_item))
+        .route("/api/items/{key}", get(get_item).patch(patch_item).delete(delete_item))
+        .route("/api/items", post(create_item))
         .route("/api/items/{key}/view", post(post_view))
         .route("/api/items/{key}/like", post(post_like))
         .route("/api/categories", post(create_category))
@@ -834,6 +971,8 @@ fn build_router(state: AppState) -> Router {
             "/api/categories/{id}",
             patch(update_category).delete(delete_category),
         )
+        .route("/api/categories/{id}/groups", post(create_group))
+        .route("/api/groups/{id}", patch(update_group).delete(delete_group))
         .route("/api/backup", get(backup_db))
         .route("/", get(web_index))
         .route("/index.html", get(web_index))