管理员后端登录管理调整

zhijiayun-user/src/main/java/com/xuekairui/user/config/SecurityConfig.java

@@ -76,6 +76,8 @@ public class SecurityConfig {
                 .authorizeHttpRequests(auth -> auth
                         // OPTIONS 预检请求直接放行（CORS 由 Nginx 处理，此处仅作兜底避免 401）
                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
+                        // 管理员登录必须在 /api/admin/** 鉴权之前，否则会被拦截返回 401
+                        .requestMatchers("/api/admin/auth/login").permitAll()
                         // 超级管理员专属：角色赋权
                         .requestMatchers("/api/admin/users/**").hasRole("SUPER_ADMIN")
                         // 运营后台接口

zhijiayun-user/src/main/java/com/xuekairui/user/controller/AdminAuthController.java

@@ -1,6 +1,7 @@
 package com.xuekairui.user.controller;
 
 import com.xuekairui.common.Result;
+import com.xuekairui.common.ValidateUtil;
 import com.xuekairui.user.dto.LoginResponse;
 import com.xuekairui.user.service.AdminAuthService;
 import jakarta.servlet.http.HttpServletRequest;
@@ -31,10 +32,7 @@ public class AdminAuthController {
             account = body.get("phone");
         }
         String password = body.get("password");
-        String ip = request.getHeader("X-Forwarded-For");
-        if (ip == null || ip.isBlank()) {
-            ip = request.getRemoteAddr();
-        }
+        String ip = ValidateUtil.getClientIp(request);
         return Result.success(adminAuthService.passwordLogin(account, password, ip));
     }
 }