Refactor global styles and enhance MITM functionality

- Updated global CSS to implement a new brand color palette and improve light/dark theme consistency.
- Enhanced the MitmServerCard component to provide clearer user feedback regarding admin privileges.
- Filtered LLM combos in the CombosPage to ensure only relevant data is displayed.
- Improved APIPageClient layout for better usability and visual consistency.
- Added functionality to save and load DNS tool states in the MITM manager.
- Updated OAuth configuration URLs for Qwen to reflect the new endpoint structure.
- Refined tunnel management logic to improve reliability and user experience.

src/app/api/cli-tools/antigravity-mitm/route.js

@@ -46,13 +46,22 @@ function requiresSudoPassword(pwd) {
 }
 
 function checkIsAdmin() {
-  if (!isWin) return true;
-  try {
-    require("child_process").execSync("net session >nul 2>&1", { windowsHide: true });
-    return true;
-  } catch {
-    return false;
+  if (isWin) {
+    try {
+      require("child_process").execSync("net session >nul 2>&1", { windowsHide: true });
+      return true;
+    } catch {
+      return false;
+    }
   }
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+
+function checkPrivilege(pwd) {
+  if (checkIsAdmin()) return true;
+  if (isWin) return false;
+  if (!isSudoPasswordRequired()) return true;
+  return !!pwd;
 }
 
 // GET - Full MITM status (server + per-tool DNS)
@@ -94,6 +103,13 @@ export async function POST(request) {
       );
     }
 
+    if (!checkPrivilege(pwd)) {
+      return NextResponse.json(
+        { error: isWin ? "Administrator required — restart 9Router as Administrator" : "Root or sudo password required to start MITM" },
+        { status: 403 }
+      );
+    }
+
     if (mitmRouterBaseUrl !== undefined && mitmRouterBaseUrl !== null) {
       try {
         const normalized = normalizeMitmRouterBaseUrlInput(mitmRouterBaseUrl);
@@ -149,6 +165,12 @@ export async function PATCH(request) {
     if (requiresSudoPassword(pwd)) {
       return NextResponse.json({ error: "Missing sudoPassword" }, { status: 400 });
     }
+    if (!checkPrivilege(pwd)) {
+      return NextResponse.json(
+        { error: isWin ? "Administrator required — restart 9Router as Administrator" : "Root or sudo password required to modify DNS" },
+        { status: 403 }
+      );
+    }
 
     if (action === "enable") {
       await enableToolDNS(tool, pwd);