feat(auth): protect aggregate console with password login

apps/web/src/app-shell.tsx

@@ -1,3 +1,4 @@
+import { ConsoleAuthSettings } from './auth/console-auth-settings.js';
 import { AuditPage, type AuditDataSource } from './audit/audit-page.js';
 import { createAuditApiDataSource } from './audit/audit-api-data-source.js';
 import type { ReactNode } from 'react';
@@ -250,13 +251,7 @@ function Page({
         refreshSignal={fleetRefreshSignal}
       />
     );
-  if (route.kind === 'settings-system')
-    return (
-      <section aria-labelledby="system-settings-title">
-        <h1 id="system-settings-title">系统设置</h1>
-        <p role="status">控制平面尚未提供系统设置契约，因此此功能暂不可用。</p>
-      </section>
-    );
+  if (route.kind === 'settings-system') return <ConsoleAuthSettings />;
   if (route.kind === 'not-found')
     return (
       <section>
@@ -500,7 +495,7 @@ export function AppShell({
             {(
               [
                 ['fleet', '/fleet', '实例总览'],
-                ['settings', '/settings/instances', '设置'],
+                ['settings', '/settings/system', '设置'],
               ] as const
             ).map(([key, href, label]) => (
               <li key={key}>