feat(dnfs): 左上角用户信息面板（默认折叠），新增 /whoami 身份接口

dnfs 新增 POST /whoami：解 Token payload 返回 user/is_admin，无或畸形
Token 返回 login=false（HttpOnly Cookie 模式下 JS 无法读 Token，身份
必须由后端下发）；static 加 /whoami 代理（Cookie 转 Bearer）；前端
dnfs.html 左上新增 userpanel，镜像 minimap 样式默认折叠，展开显示
用户名/角色/退出登录（POST /logout 清 Cookie 后跳登录页）。

static/fsys.py

@@ -474,6 +474,22 @@ def proxy_update_note():
         return _cors(make_response(_json.dumps({"error": str(e)}), 502, {"Content-Type": "application/json"}))
 
 
+@app.route('/whoami', methods=['POST', 'OPTIONS'])
+def proxy_whoami():
+    if request.method == "OPTIONS": return _cors(make_response("", 204))
+    try:
+        data = request.get_json(force=True, silent=True) or {}
+        h = {"Content-Type": "application/json"}
+        if "Authorization" in request.headers: h["Authorization"] = request.headers["Authorization"]
+        elif request.cookies.get("q4_token"): h["Authorization"] = f"Bearer {request.cookies['q4_token']}"  # HttpOnly Cookie 模式：Cookie 转 Bearer
+        req = _urlreq.Request(f"{DNFS_URL}/whoami", data=_json.dumps(data).encode(), headers=h, method="POST")
+        with _urlreq.urlopen(req, timeout=15) as r:
+            return _cors(make_response(r.read().decode(), 200, {"Content-Type": "application/json"}))
+    except Exception as e:
+        logs.warning("static", "dnfs whoami 代理失败", extra={"error": str(e)})
+        return _cors(make_response(_json.dumps({"error": str(e)}), 502, {"Content-Type": "application/json"}))
+
+
 @app.route('/api/proxy_send_code', methods=['POST'])
 def proxy_send_code():
     from flask import request, jsonify