终端 header 显示当前在线人数

- src/utils/online_tracker.py：5 分钟滑动窗口，thread-safe 内存追踪
- web/core.py：认证成功时 record_activity(user_id)
- web/routers/ops.py：GET /api/ops/online-users 返回 {online: N}
- 前端 header 每 60s 轮询，Users 图标 + 数字

web/core.py

@@ -230,6 +230,8 @@ def _bind_optional_supabase_identity(request: Request) -> None:
     request.state.auth_email = identity.email
     request.state.auth_points = identity.points
     request.state.auth_created_at = identity.created_at
+    from src.utils.online_tracker import record_activity
+    record_activity(identity.user_id)
 
 
 def _resolve_auth_points(request: Request) -> int:
@@ -306,6 +308,8 @@ def _assert_entitlement(request: Request) -> None:
 
         request.state.auth_user_id = identity.user_id
         request.state.auth_email = identity.email
+        from src.utils.online_tracker import record_activity
+        record_activity(identity.user_id)
         return
 
     if not _ENTITLEMENT_GUARD_ENABLED: