feat: 添加用户 Token 认证支持

- 新增 TLBM_TOKEN 环境变量
- 非 admin 接口支持 Bearer Token 认证
- admin 接口继续使用 X-Admin-Key

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/index.ts

@@ -16,6 +16,7 @@ import {
 // API 配置
 const API_BASE_URL = process.env.TLBM_API_URL || "https://www.atomdancing.com/pm";
 const ADMIN_KEY = process.env.TLBM_ADMIN_KEY || "";
+const USER_TOKEN = process.env.TLBM_TOKEN || "";
 
 // HTTP 请求函数
 async function httpRequest(method: string, path: string, params?: Record<string, any>, body?: any, headers?: Record<string, string>): Promise<any> {
@@ -35,6 +36,12 @@ async function httpRequest(method: string, path: string, params?: Record<string,
     ...headers,
   };
   
+  // 用户 Token 认证（所有非 admin 接口）
+  if (USER_TOKEN && !path.startsWith("/api/admin")) {
+    fetchHeaders["Authorization"] = `Bearer ${USER_TOKEN}`;
+  }
+  
+  // Admin Key 认证（admin 接口）
   if (ADMIN_KEY && path.startsWith("/api/admin")) {
     fetchHeaders["X-Admin-Key"] = ADMIN_KEY;
   }