feat(桌面与监控): 完善工作台导航和登录活动定位

- 优化桌面标签、上下文标题、前进后退、导航栏隐藏和原生菜单体验

- 补充登录会话 IP 采集、地理位置回退、管理端展示及数据库迁移

- 更新桌面发布检查、运维文档和前后端测试覆盖

backend/tests/test_permission_monitoring_api.py

@@ -13,6 +13,7 @@ from app.core.permission_monitor import set_permission_monitor, PermissionMonito
 from app.api.v1 import permission_monitoring
 from app.api.v1.system_permissions import list_system_permissions
 from app.services.monitoring_server_location import MonitoringServerLocation
+from app.services.ip_geolocation_fallback import ExternalIpLocation
 
 
 class FakeIpInfo:
@@ -583,6 +584,57 @@ async def test_ip_locations_counts_unique_users_per_location(db_session, monkeyp
     assert sorted(resolved_ips) == ["10.1.1.1", "10.1.1.2", "10.1.1.3"]
 
 
+@pytest.mark.asyncio
+async def test_ip_locations_uses_external_coordinates_only_when_local_coordinates_are_missing(db_session, monkeypatch):
+    await db_session.execute(text("DELETE FROM permission_access_logs"))
+    await db_session.execute(text("DELETE FROM security_access_logs"))
+    await db_session.commit()
+    study_id = uuid.uuid4()
+    user_id = uuid.uuid4()
+    await _seed_permission_log(db_session, study_id, user_id, allowed=True, elapsed_ms=3.2)
+    await db_session.execute(
+        text("UPDATE permission_access_logs SET ip_address = :ip_address"),
+        {"ip_address": "8.8.8.8"},
+    )
+    await db_session.commit()
+
+    monkeypatch.setattr(
+        permission_monitoring,
+        "resolve_ip_location",
+        lambda _ip: FakeIpInfo("", "", isp="", country="未知国家"),
+    )
+
+    async def fake_external_lookup(ip_addresses):
+        assert ip_addresses == ["8.8.8.8"]
+        return {
+            "8.8.8.8": ExternalIpLocation(
+                ip_address="8.8.8.8",
+                country="United States of America",
+                country_code="US",
+                region="California",
+                city="Mountain View",
+                isp="Google LLC",
+                longitude=-122.08385,
+                latitude=37.38605,
+            )
+        }
+
+    monkeypatch.setattr(permission_monitoring, "resolve_external_ip_locations", fake_external_lookup)
+
+    result = await permission_monitoring.get_ip_locations(
+        db=db_session,
+        _=AdminUserStub(),
+        days=7,
+        limit=10,
+    )
+
+    assert result["items"][0]["longitude"] == -122.08385
+    assert result["items"][0]["latitude"] == 37.38605
+    assert result["items"][0]["city"] == "Mountain View"
+    assert result["data_quality"]["external_fallback_ip_count"] == 1
+    assert result["data_quality"]["resolver"] == "ip2region+ip2location.io"
+
+
 @pytest.mark.asyncio
 async def test_ip_locations_merges_same_region_with_different_isp(db_session, monkeypatch):
     """同一省市的 IP 属地统计不应因运营商不同拆分。"""