feat: 门禁增强 — 输错5次锁定1h + 退出登录

server/api/logout.post.ts

@@ -0,0 +1,11 @@
+// 退出登录：清除 HTTP-only 的访问 cookie
+export default defineEventHandler((event) => {
+  if (!process.env.WEBPASSWORD) return { ok: true }
+  setCookie(event, 'web_unlock', '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0
+  })
+  return { ok: true }
+})