Evidence： 任务卡三段输出（precheck/task-sync/make test 均由 make evidence 写入）：组合 make test exit 0（governance 133、pins ok、frontend 93/93、ui 106/106）；backend/internal/frontend 子仓 CI GATE 已绿并合入。
Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-admin-auth-gate-fix.md; R0=2e43e71209384b356ebfe664e9f27492fd514977.
Impact: task metadata only; the feature workspace starts at 2e43e71209.
Refs: .task/feature-admin-auth-gate-fix.md
Why: an admin with a stale API key in localStorage was 401'd on every
request despite a valid session (Bearer precedence), and API-key holders
entering the forced-change gate could never complete it (passwords are
session-owned) while every 401 showed "wrong username or password",
masking the real cause.
Evidence: backend go test ./... and frontend vitest 93/93 green locally
(SELF); sub-repo PRs Backend#153 / Frontend#54 carry GATE CI; combined
make test evidence recorded in the task card.
Impact: pins backend 6681c3b and frontend dc18d6c via gitlinks; fills
the task card with diagnosis, requirements R1-R4 and plan.
Refs: task feature/admin-auth-gate-fix.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=259270b4e339132219490b95b42d12386f9abe1e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: the auth fixes landed in sub-repo main via Backend#153/#154 and
Frontend#54; the Dev tree must pin them for combined verification and
release. Also records the first make-test attempt, which failed on
test-pins due to the pre-existing backend core misalignment fixed by
Backend#154.
Evidence: gitlink pins backend 44d45e1 (auth fallback + core repin) and
frontend fcf40ff (gate fix); combined make test evidence follows in the
task card.
Impact: none beyond the recorded pins.
Refs: task feature/admin-auth-gate-fix.
Why: completion claims require tool-written evidence for precheck,
task-sync and tests; the combined run also validates the realigned
backend core pin (Backend#154) and both auth fixes end to end.
Evidence: CMD="make test" make evidence, exit 0 (governance 133 tests,
pins ok, libs/core/backend green, frontend 93/93, ui 106/106).
Impact: none beyond the card.
Refs: task feature/admin-auth-gate-fix.
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=03b2adfdc218b45ae2a3f8172fea4110783a4e05.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=27fa4fda7a0dbdf9228f9575f3fd50ca5974df76.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
# Conflicts:
# modules/frontend
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=53a3effef777c83bd6baa63f8181f34480533559.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=3ef65a91428cf28e73dd2a23127dda014e455d87.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
任务卡：.task/feature-admin-auth-gate-fix.md（同文档为 PR 描述）
Why: 管理员报告在用户管理页遇 /api/auth/login 401 且界面被改密门替换。诊断钉实三处叠加缺陷：① /api/me 对 API-key 凭证也报 mustChangePassword，但改密只认会话 → key 持有者死锁在改密门；② 改密表单把一切 401 显示「用户名或密码不正确」，掩盖真实原因；③ 中间件 Bearer 优先于会话 cookie，localStorage 残留失效 key 使有效会话全部 401（dev 实例当场复现）。
改动： Backend#153（middleware 失效 key 回落会话 + /api/me authVia）、Frontend#54（key+mustChange 清 key 回登录页；改密错误文案分因；API-key tab 拦截）、Backend#154（顺带修复：PR #152 依据过时信息把内置 core 钉回 7a98a7e，与 Dev core 89f3906 错位，阻塞一切 Dev gitlink 推进的 check-pins）。
Evidence： 任务卡三段输出（precheck/task-sync/make test 均由 make evidence 写入）：组合 make test exit 0（governance 133、pins ok、frontend 93/93、ui 106/106）；backend/internal/frontend 子仓 CI GATE 已绿并合入。
Impact： 浏览器残留失效 key 不再锁死管理员；改密门错误可自助处置；Dev 可继续推进 backend gitlink。
Refs： Backend#153、Backend#154、Frontend#54。