feat: add community enhancements — password reset, audit logs, multi-source backup

Three community-requested features:

1. CLI password reset: `backupx reset-password --username admin --password xxx`
   Docker users can run via `docker exec`. No full app init needed.

2. Audit logging: async fire-and-forget audit trail for all key operations
   (login, CRUD on tasks/targets/records, settings changes).
   New UI page at /audit with category filter and pagination.

3. Multi-source path backup: file backup tasks now support multiple source
   directories packed into a single tar archive. Backward compatible with
   existing single sourcePath field.

server/internal/http/database_handler.go

@@ -0,0 +1,30 @@
+package http
+
+import (
+	"backupx/server/internal/apperror"
+	"backupx/server/internal/service"
+	"backupx/server/pkg/response"
+	"github.com/gin-gonic/gin"
+)
+
+type DatabaseHandler struct {
+	service *service.DatabaseDiscoveryService
+}
+
+func NewDatabaseHandler(service *service.DatabaseDiscoveryService) *DatabaseHandler {
+	return &DatabaseHandler{service: service}
+}
+
+func (h *DatabaseHandler) Discover(c *gin.Context) {
+	var input service.DatabaseDiscoverInput
+	if err := c.ShouldBindJSON(&input); err != nil {
+		response.Error(c, apperror.BadRequest("DATABASE_DISCOVER_INVALID", "数据库发现参数不合法", err))
+		return
+	}
+	result, err := h.service.Discover(c.Request.Context(), input)
+	if err != nil {
+		response.Error(c, err)
+		return
+	}
+	response.Success(c, result)
+}