Add admin official account connection UI and persistent session secrets

README.md

@@ -213,3 +213,20 @@ compatible; new endpoints are included in generated OpenAPI and contract tests.
 The daily-poetry template includes 20 public-domain classical Chinese poems, selected deterministically by Shanghai date, or manually. Create a daily job from its editor; new poetry jobs are paused by default until you enable them. Custom title, author and verses are editable. This is an independent Frame Flow content provider, not the KoKonna mini-program subscription. Official public API does not expose mini-program subscription/template settings.
 
 每日诗词支持按上海日期选诗、手选 20 首古典诗词、自定义文本以及每日任务。模板显示操作使用统一上传/显示服务；真实写入须开启 KOKONNA_WRITE_ENABLED，结果未知不会自动重试。官方小程序原有每日诗词订阅不能通过当前公开 API 查询或修改。
+
+
+### 官方账号连接 / Official account connection
+
+在 Templates → 官方小组件中，由管理员输入 KoKonna 官方账号和密码，查询账号下
+的设备后手动关联当前 Frame Flow 设备。此流程不绑定或解绑云端设备，也不改变
+图片或订阅。现有 API Key 接入继续负责设备、图库和显示能力。
+
+密码不保存；会话与关联信息保存在 `/config/official-{device_id}.secret`，权限 0600。
+容器重启可恢复连接。会话过期需要重新登录；断开连接会清除本地会话，不撤销
+官方服务器上的其他登录。局域网访问沿用现有部署方式。
+
+Official account connection is admin-only and separate from API Key access.
+Login, device discovery, local association and disconnect are available through
+`/api/v1/devices/{device_id}/official/connection`. Passwords are never persisted;
+server-side sessions are stored as restricted secret files. No official widget
+mutation or other extra RPC write is enabled by connecting.