fix: 同步两个页面的弹窗结构

- index.html 添加 profileModal HTML
- analysis.html 移除错误位置的 twofaBindModal
- analysis.html 添加 twofaBindModal 到正确位置
- analysis.html profileModal 添加完整 2FA 设置部分
- 两个页面的 header/menu/modal 现在一致

不打包，等用户确认后再打包

frontend/admin.html

@@ -147,7 +147,7 @@ tr:hover{background:#f8fafc}
     </div>
     <div class="card-body">
       <table>
-        <thead><tr><th>账号</th><th>昵称</th><th>邮箱</th><th>角色</th><th>组</th><th>债务</th><th>状态</th><th>操作</th></tr></thead>
+        <thead><tr><th>账号</th><th>昵称</th><th>邮箱</th><th>角色</th><th>组</th><th>债务</th><th>状态</th><th>2FA</th><th>操作</th></tr></thead>
         <tbody id="userTable"></tbody>
       </table>
     </div>
@@ -348,7 +348,9 @@ async function loadUsers(){
       actions+=` <button class="btn-sm btn-enable" onclick="sendResetLink(${u.id},'${escapeHtml(u.account)}')">改密</button>`;
       actions+=` <button class="btn-sm btn-danger" onclick="deleteUser(${u.id},'${escapeHtml(u.account)}')">删除</button>`;
     }
-    return`<tr><td>${escapeHtml(u.account)}</td><td>${escapeHtml(u.nickname)}</td><td>${emailDisplay}</td><td>${roleBadge}</td><td>${groupBadge}</td><td>${u.debt_count}笔</td><td>${statusBadge}</td><td>${actions}</td></tr>`;
+    return`<tr><td>${escapeHtml(u.account)}</td><td>${escapeHtml(u.nickname)}</td><td>${emailDisplay}</td><td>${roleBadge}</td><td>${groupBadge}</td><td>${u.debt_count}笔</td><td>${statusBadge}</td>
+        <td>${u.role==='admin'?'<span style="color:#94a3b8">-</span>':(u.two_factor_enabled?'<span class="badge badge-active">已启用</span> <button class="btn-sm btn-disable" onclick="toggleUser2FA('+u.id+',false)">禁用</button>':'<span class="badge badge-disabled">未启用</span> <button class="btn-sm btn-enable" onclick="toggleUser2FA('+u.id+',true)">启用</button>')}</td>
+        <td>${actions}</td></tr>`;
   }).join('');
 }
 
@@ -514,6 +516,25 @@ function renderNotifList(items){const el=$("notifList");if(!items.length){el.inn
 async function readNotif(id){await apiFetch('/notifications/'+id+'/read',{method:'PUT'});loadNotifications();}
 async function markAllNotifRead(){await apiFetch('/notifications/read-all',{method:'PUT'});loadNotifications();}
 
+
+async function toggleUser2FA(userId, enabled) {
+  const action = enabled ? '启用' : '禁用';
+  if (!confirm(`确定${action}该用户的双因素认证？`)) return;
+  
+  const res = await apiFetch('/admin/users/' + userId + '/2fa', {
+    method: 'PUT',
+    body: JSON.stringify({enabled})
+  });
+  
+  if (res && res.ok) {
+    alert(`用户 2FA 已${action}`);
+    loadUsers();
+  } else {
+    const data = await res.json().catch(() => ({}));
+    alert(data.detail || '操作失败');
+  }
+}
+
 init();
 </script>
 </body>