fix(config): allow local integration frontend

backend/src/main/java/com/xyw/console/config/WebConfig.java

@@ -13,9 +13,10 @@ public class WebConfig implements WebMvcConfigurer {
    * 关联逻辑（调用链/消息链/数据流）：浏览器 fetch -> /api/** -> addCorsMappings() -> 后端控制器正常返回 JSON。
    */
   @Override
+  /** 代码作用（白话）：允许指定本地前端端口调用后端接口。CORS（浏览器限制不同端口互访的安全规则）需要列出 5175；否则浏览器会在密码校验前以 403 拒绝登录。关联文件：frontend/vite.config.js、SecurityConfig.java。关联逻辑（调用链/消息链/数据流）：浏览器 5173/5175 -> /api/** -> addCorsMappings() -> 后端控制器。 */
   public void addCorsMappings(CorsRegistry registry) {
     registry.addMapping("/api/**")
-      .allowedOrigins("http://localhost:8000", "http://127.0.0.1:8000", "http://localhost:5173", "http://127.0.0.1:5173")
+      .allowedOrigins("http://localhost:8000", "http://127.0.0.1:8000", "http://localhost:5173", "http://127.0.0.1:5173", "http://localhost:5175", "http://127.0.0.1:5175")
       .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
       .allowedHeaders("*")
       .allowCredentials(true);

backend/src/test/java/com/xyw/console/config/WebConfigTest.java

+package com.xyw.console.config;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+
+/** File purpose (plain language): verifies local development frontends that use an approved port can call the backend API. */
+class WebConfigTest {
+  /** Plain purpose: ensure the separate 5175 integration frontend is allowed to send login requests to the local backend. Related files: WebConfig.java, frontend/vite.config.js. Flow: browser origin -> CORS allowlist -> /api/auth/login -> authentication controller. */
+  @Test void allowsIntegrationFrontendOnPort5175() {
+    InspectableCorsRegistry registry = new InspectableCorsRegistry();
+    new WebConfig().addCorsMappings(registry);
+    CorsConfiguration configuration = registry.configurations().get("/api/**");
+
+    assertTrue(configuration.getAllowedOrigins().contains("http://127.0.0.1:5175"));
+  }
+
+  /** Plain purpose: expose Spring's protected test-only CORS mapping view without changing production configuration. Related files: WebConfig.java. Flow: WebConfig registration -> registry map -> assertion. */
+  private static final class InspectableCorsRegistry extends CorsRegistry {
+    /** Plain purpose: return the mappings registered by WebConfig for a direct allowlist assertion. Related files: WebConfigTest.java. Flow: addCorsMappings -> configurations -> expected local origin. */
+    java.util.Map<String, CorsConfiguration> configurations() { return getCorsConfigurations(); }
+  }
+}