I'm building a similar system. Some data stored on the blockchain, some stored in a traditional DB, and my personal approach may interest you.
Is safe to login into a classic account with just the web3.eth.accounts and no PW?
The question that you are really asking is "Can you trick web3 into believing you control the private key of an address when you really don't?".
From my understanding and my own attempts at trying to trick web3 the answer is no. This would mean that using the existence of
web3.eth.accounts would be proof that the user has the private key of the address.
Yes it is possible to trick web3 into believing you own a public key you do not have the private key for. See atfornes' answer https://ethereum.stackexchange.com/a/16970/2673
Is safe to login into a classic account with just the web3.eth.accounts and no PW? , I would say yes, but you will need to prove that the user controls the associated private key via a method of signing. See How can I sign a piece of data with the private key of an Ethereum address?
Is it possible to ask for the user permission (like the "accept" prompt with Metamask) but without mining a transaction (too long for a login)?
If you want the user to confirm that they would like to be validated as a user with their
web3.eth.accounts, you can simply store this data in your traditional DB. I don't see any advantage storing this in a contract. But you will need the user to prove they own the public address by signing some data with the related private key.
Is there another way to enable single-click login?
One of the beauties of using a platform like Ethereum is that you can build a ZERO click login.
If we establish that the user's
web3.eth.accounts is proof that the user controls the private key of that account's address, then you will always know that the user is valid.
But you will need some kind of client side script to collect proof that the user has the private key for the public address representing their account.