docs: 交付文档、维护指引与端到端回归

补齐 README、开发计划、维护交接与 E2E 用例，执行最终验收。

e2e/specs/security/headers.spec.ts

@@ -0,0 +1,38 @@
+import { test, expect, env, seedUsers, ApiClient } from '@e2e'
+
+// What the backend itself promises about cookies and cross-origin access.
+// (Security headers such as HSTS and CSP come from the host's nginx, which is not
+// in this repo, so they are checked against a deployment, not here.)
+
+test.describe('security basics', () => {
+  test('sign-in tokens are HttpOnly, Secure cookies @security', async ({ playwright }) => {
+    const context = await playwright.request.newContext()
+    const response = await context.post(`${env.apiUrl}/users/login`, {
+      form: { username: seedUsers.admin.email, password: seedUsers.admin.password },
+    })
+    expect(response.ok()).toBe(true)
+    const cookies = response.headersArray().filter((h) => h.name.toLowerCase() === 'set-cookie').map((h) => h.value)
+    for (const name of ['access_token', 'refresh_token']) {
+      const cookie = cookies.find((c) => c.startsWith(`${name}=`))
+      expect(cookie, `${name} cookie`).toBeDefined()
+      expect(cookie).toMatch(/;\s*HttpOnly/i)
+      expect(cookie).toMatch(/;\s*Secure/i)
+    }
+    await context.dispose()
+  })
+
+  test('another website cannot call the API with a visitor\'s credentials @security', async ({ request }) => {
+    const response = await new ApiClient(request).raw('OPTIONS', '/users/me', {
+      headers: { Origin: 'https://evil.example', 'Access-Control-Request-Method': 'GET' },
+    })
+    expect(response.headers()['access-control-allow-origin']).toBeUndefined()
+  })
+
+  test('the dashboard\'s own origin is allowed @security', async ({ request }) => {
+    const response = await new ApiClient(request).raw('OPTIONS', '/users/me', {
+      headers: { Origin: env.frontendUrl, 'Access-Control-Request-Method': 'GET' },
+    })
+    expect(response.headers()['access-control-allow-origin']).toBe(env.frontendUrl)
+    expect(response.headers()['access-control-allow-credentials']).toBe('true')
+  })
+})