feat(web): restore candidate notice on home for logged-in users

reaction_board/web/static/app.js

@@ -1,6 +1,7 @@
 import { session, visit } from "./api.js";
 import { disposeAll } from "./charts.js";
 import { onRoute, parseLocation, startRouter } from "./router.js";
+import { canAccessProtected, setSession } from "./session.js";
 import { renderCandidates } from "./views/candidates.js";
 import { renderFans } from "./views/fans.js";
 import { renderHome } from "./views/home.js";
@@ -51,12 +52,6 @@ function renderLegacyRank(root, context) {
     : renderVideos(root, context);
 }
 
-let authState = { authEnabled: false, authenticated: true };
-
-function canAccessProtected() {
-  return !authState.authEnabled || authState.authenticated;
-}
-
 function requireAuth() {
   if (canAccessProtected()) return true;
   const { path, query } = parseLocation();
@@ -152,10 +147,7 @@ async function boot() {
   const banner = document.querySelector("#preview-banner");
   try {
     const data = await session();
-    authState = {
-      authEnabled: Boolean(data?.auth_enabled),
-      authenticated: data?.authenticated !== false,
-    };
+    setSession(data);
     if (data?.preview) {
       banner.hidden = false;
     }

reaction_board/web/static/session.js

@@ -0,0 +1,26 @@
+// 登录态与预览态的进程内共享状态。
+// app.js 在 boot 时写入，各视图（如 home.js）读取，避免重复请求 /api/session。
+
+let state = { authEnabled: false, authenticated: true, preview: false };
+
+export function setSession(data) {
+  state = {
+    authEnabled: Boolean(data?.auth_enabled),
+    authenticated: data?.authenticated !== false,
+    preview: Boolean(data?.preview),
+  };
+  return state;
+}
+
+export function getSession() {
+  return state;
+}
+
+// 可访问「候选 / 系统」等受保护页面：未启用鉴权，或已登录。
+export function canAccessProtected() {
+  return !state.authEnabled || state.authenticated;
+}
+
+export function isPreview() {
+  return state.preview;
+}

reaction_board/web/static/views/home.js

@@ -4,6 +4,7 @@ import {
   escapeAttr, escapeHtml, formatCount, formatDate, formatDelta,
   formatDuration, formatPercent, formatScore,
 } from "../format.js";
+import { canAccessProtected } from "../session.js";
 
 function statChip(label, value, { href = null, tone = "" } = {}) {
   const inner = `<span>${escapeHtml(label)}</span><strong>${value}</strong>`;
@@ -55,6 +56,9 @@ export async function renderHome(root) {
     ? formatCount(overview.initial_import_count)
     : formatCount(overview.added_today);
   const activeCount = overview.counts?.active || 0;
+  const pending = overview.counts?.candidates_pending || 0;
+  // 候选提示仅对已登录（或未启用鉴权）用户可见，访客不展示运行期信息。
+  const showCandidates = pending > 0 && canAccessProtected();
 
   root.innerHTML = `<section class="page home-page">
     <header class="page-head home-head">
@@ -78,6 +82,11 @@ export async function renderHome(root) {
       ${statChip("数据日期", escapeHtml(overview.data_date || "—"))}
     </div>
 
+    ${showCandidates ? `<a class="notice-row" href="/candidates">
+      <strong>${formatCount(pending)} 条候选待确认</strong>
+      <span>请在 Telegram 中处理 →</span>
+    </a>` : ""}
+
     <section class="panel">
       <div class="section-head">
         <h2>最近发布</h2>