fix: 修复全部27个失败的e2e测试

根本原因: 所有测试硬编码了只在生产环境有效的admin token，
CI创建新数据库时token不同导致全部认证失败。

修复:
- CI: 设置已知ADMIN_TOKEN环境变量传给后端和Cypress
- cypress/support/e2e.js: 新增cy.getAdminToken()动态获取token
- 24个spec文件: 硬编码token改为cy.getAdminToken()
- UI选择器: 适配管理页面从tab移到UserMenu、编辑器DOM变化
- API: create_recipe→share_recipe、ingredients格式、权限变化
- 超时: 300s→420s适应32个spec

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/cypress/e2e/admin-flow.cy.js

@@ -1,41 +1,62 @@
 describe('Admin Flow', () => {
-  const ADMIN_TOKEN = 'c86ae7afbe10fabe3c1d5e1a7fee74feaadfd5dc7be2ab62'
+  let adminToken
+
+  before(() => {
+    cy.getAdminToken().then(token => { adminToken = token })
+  })
 
   beforeEach(() => {
     cy.visit('/', {
       onBeforeLoad(win) {
-        win.localStorage.setItem('oil_auth_token', ADMIN_TOKEN)
+        win.localStorage.setItem('oil_auth_token', adminToken)
       }
     })
-    cy.get('.nav-tab', { timeout: 10000 }).should('have.length.gte', 6)
+    cy.get('.nav-tab', { timeout: 10000 }).should('have.length.gte', 3)
   })
 
-  it('shows admin-only tabs', () => {
-    cy.get('.nav-tab').contains('操作日志').should('be.visible')
-    cy.get('.nav-tab').contains('Bug').should('be.visible')
-    cy.get('.nav-tab').contains('用户管理').should('be.visible')
+  it('shows standard tabs for logged-in users', () => {
+    cy.get('.nav-tab').contains('配方查询').should('be.visible')
+    cy.get('.nav-tab').contains('管理配方').should('be.visible')
+    cy.get('.nav-tab').contains('精油价目').should('be.visible')
   })
 
-  it('can access manage recipes page', () => {
+  it('admin pages accessible via URL (audit log)', () => {
+    cy.visit('/audit', {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('oil_auth_token', adminToken)
+      }
+    })
+    cy.contains('操作日志', { timeout: 10000 }).should('be.visible')
+  })
+
+  it('admin pages accessible via URL (user management)', () => {
+    cy.visit('/users', {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('oil_auth_token', adminToken)
+      }
+    })
+    cy.contains('用户管理', { timeout: 10000 }).should('be.visible')
+  })
+
+  it('admin pages accessible via URL (bug tracker)', () => {
+    cy.visit('/bugs', {
+      onBeforeLoad(win) {
+        win.localStorage.setItem('oil_auth_token', adminToken)
+      }
+    })
+    cy.contains('Bug', { timeout: 10000 }).should('be.visible')
+  })
+
+  it('can access manage recipes page via tab', () => {
     cy.get('.nav-tab').contains('管理配方').click()
     cy.url().should('include', '/manage')
   })
 
-  it('can access audit log page', () => {
-    cy.get('.nav-tab').contains('操作日志').click()
-    cy.url().should('include', '/audit')
-    cy.contains('操作日志').should('be.visible')
-  })
-
-  it('can access user management page', () => {
-    cy.get('.nav-tab').contains('用户管理').click()
-    cy.url().should('include', '/users')
-    cy.contains('用户管理').should('be.visible')
-  })
-
-  it('can access bug tracker page', () => {
-    cy.get('.nav-tab').contains('Bug').click()
-    cy.url().should('include', '/bugs')
-    cy.contains('Bug').should('be.visible')
+  it('user menu shows admin links', () => {
+    // Open user menu by clicking username
+    cy.get('.user-name').click()
+    cy.get('.usermenu-card', { timeout: 5000 }).should('be.visible')
+    cy.get('.usermenu-btn').contains('操作日志').should('be.visible')
+    cy.get('.usermenu-btn').contains('用户管理').should('be.visible')
   })
 })