fix: validate login and role inputs and protect task access

web/static/i18n/en-US.json

@@ -1965,6 +1965,7 @@
     "forbidden": "Insufficient permissions",
     "requestFailed": "Request failed",
     "enterPassword": "Please enter password",
+    "usernameRequired": "Enter a username of at most 64 characters",
     "loginFailedCheck": "Sign-in failed, please check the username or password",
     "loginFailedRetry": "Sign-in failed, please try again later",
     "loggedOut": "Signed out"

web/static/i18n/ru-RU.json

@@ -1978,6 +1978,7 @@
     "forbidden": "Недостаточно прав",
     "requestFailed": "Запрос не выполнен",
     "enterPassword": "Введите пароль",
+    "usernameRequired": "Введите имя пользователя длиной не более 64 символов",
     "loginFailedCheck": "Вход не выполнен, проверьте имя пользователя или пароль",
     "loginFailedRetry": "Вход не выполнен, повторите позже",
     "loggedOut": "Вы вышли"

web/static/i18n/zh-CN.json

@@ -1953,6 +1953,7 @@
     "forbidden": "权限不足",
     "requestFailed": "请求失败",
     "enterPassword": "请输入密码",
+    "usernameRequired": "用户名不能为空，且不能超过 64 个字符",
     "loginFailedCheck": "登录失败，请检查用户名或密码",
     "loginFailedRetry": "登录失败，请稍后重试",
     "loggedOut": "已退出登录"

web/static/js/auth.js

@@ -257,6 +257,14 @@ async function submitLogin(event) {
 
     const username = usernameInput ? usernameInput.value.trim() : '';
     const password = passwordInput.value.trim();
+    if (!username || Array.from(username).length > 64) {
+        if (errorBox) {
+            errorBox.textContent = typeof window.t === 'function' ? window.t('auth.usernameRequired') : '用户名不能为空，且不能超过 64 个字符';
+            errorBox.style.display = 'block';
+        }
+        if (usernameInput) usernameInput.focus();
+        return;
+    }
     if (!password) {
         if (errorBox) {
             const msgEmpty = (typeof window !== 'undefined' && typeof window.t === 'function')

web/templates/index.html

@@ -53,7 +53,7 @@
             <form id="login-form" class="login-form">
                 <div class="form-group">
                     <label for="login-username" data-i18n="login.usernameLabel">用户名</label>
-                    <input type="text" id="login-username" placeholder="admin" autocomplete="username" data-i18n="login.usernamePlaceholder" data-i18n-attr="placeholder" />
+                    <input type="text" id="login-username" placeholder="admin" required maxlength="64" autocomplete="username" data-i18n="login.usernamePlaceholder" data-i18n-attr="placeholder" />
                 </div>
                 <div class="form-group">
                     <label for="login-password" data-i18n="login.passwordLabel">密码</label>