功能：优化账号分层与管理员初始化

backend/internal/service/auth.go

@@ -86,7 +86,9 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 	return s.db.Model(&user).Update("password_hash", string(hash)).Error
 }
 
-func (s *AuthService) EnsureAdmin() error {
+// EnsureAdmin creates the first platform administrator for an empty database.
+// Existing administrator accounts are never changed by environment variables.
+func (s *AuthService) EnsureAdmin(username, password string) error {
 	var count int64
 	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
 	if count > 0 {
@@ -103,14 +105,21 @@ func (s *AuthService) EnsureAdmin() error {
 		}
 		return nil
 	}
-	hash, err := bcrypt.GenerateFromPassword([]byte("admin123"), bcrypt.DefaultCost)
+	username = strings.TrimSpace(username)
+	if len(username) < 3 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
+	}
+	if len(password) < 8 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 	admin := &model.User{
-		Username:     "admin",
+		Username:     username,
 		PasswordHash: string(hash),
-		Nickname:     "管理员",
+		Nickname:     username,
 		Role:         model.RoleAdmin,
 		Status:       1,
 	}

backend/internal/service/merchant_test.go

@@ -224,3 +224,57 @@ func TestUserServiceCannotDeleteOrDisableLastAdmin(t *testing.T) {
 		t.Fatal("should not delete the last enabled admin")
 	}
 }
+
+func TestUserServicePromotesMerchantAccountToPlatformAdmin(t *testing.T) {
+	db := newServiceTestDB(t)
+	var merchant model.Merchant
+	if err := db.Where("code = ?", model.MerchantCodeSelfOperated).First(&merchant).Error; err != nil {
+		t.Fatalf("load self-operated merchant: %v", err)
+	}
+	svc := NewUserService(db, NewTenantService(db))
+	actor, err := svc.Create("existing-admin", "password123", "现有管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create actor: %v", err)
+	}
+	member, err := svc.Create("skin_nh_admin", "password123", "新管理员", model.RoleMerchant, 0)
+	if err != nil {
+		t.Fatalf("create merchant user: %v", err)
+	}
+	if err := svc.UpdateRole(member.ID, model.RoleAdmin, actor.ID); err != nil {
+		t.Fatalf("promote account: %v", err)
+	}
+	var promoted model.User
+	if err := db.First(&promoted, member.ID).Error; err != nil || promoted.Role != model.RoleAdmin {
+		t.Fatalf("account should be admin, user=%+v err=%v", promoted, err)
+	}
+	var membership model.MerchantMember
+	if err := db.Where("merchant_id = ? AND user_id = ?", merchant.ID, member.ID).First(&membership).Error; err != nil {
+		t.Fatalf("promoted account should join self-operated merchant: %v", err)
+	}
+	if membership.Role != model.MemberRoleOwner || !membership.IsDefault {
+		t.Fatalf("unexpected promoted membership: %+v", membership)
+	}
+}
+
+func TestEnsureAdminUsesConfiguredCredentialsOnlyForEmptyDatabase(t *testing.T) {
+	db := newServiceTestDB(t)
+	tenant := NewTenantService(db)
+	auth := NewAuthService(db, nil, tenant)
+	if err := auth.EnsureAdmin("skin_nh_admin", "secure-password"); err != nil {
+		t.Fatalf("create configured admin: %v", err)
+	}
+	var created model.User
+	if err := db.Where("username = ?", "skin_nh_admin").First(&created).Error; err != nil {
+		t.Fatalf("configured admin should exist: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(created.PasswordHash), []byte("secure-password")); err != nil {
+		t.Fatalf("configured password should match: %v", err)
+	}
+	if err := auth.EnsureAdmin("replacement-admin", "another-password"); err != nil {
+		t.Fatalf("existing admin should not be replaced: %v", err)
+	}
+	var count int64
+	if err := db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count).Error; err != nil || count != 1 {
+		t.Fatalf("existing admin should remain unchanged, count=%d err=%v", count, err)
+	}
+}

backend/internal/service/user.go

@@ -7,6 +7,7 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type UserService struct {
@@ -58,6 +59,23 @@ func (s *UserService) List(q UserListQuery) ([]model.User, int64, error) {
 	return list, total, err
 }
 
+// ListMerchantMembers returns employee assignments across merchants for platform operations.
+func (s *UserService) ListMerchantMembers(page, size int) ([]model.MerchantMember, int64, error) {
+	page, size = normalizePage(page, size)
+	tx := s.db.Model(&model.MerchantMember{}).
+		Joins("JOIN users ON users.id = merchant_members.user_id AND users.deleted_at IS NULL").
+		Where("users.role = ?", model.RoleMerchant)
+	var total int64
+	if err := tx.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var members []model.MerchantMember
+	err := tx.Preload("Merchant").Preload("User").
+		Order("merchant_members.merchant_id ASC, merchant_members.id ASC").
+		Offset((page - 1) * size).Limit(size).Find(&members).Error
+	return members, total, err
+}
+
 func (s *UserService) Create(username, password, nickname, role string, merchantID uint) (*model.User, error) {
 	var count int64
 	s.db.Model(&model.User{}).Where("username = ?", username).Count(&count)
@@ -137,6 +155,58 @@ func (s *UserService) UpdateStatus(id uint, status int) error {
 	})
 }
 
+// UpdateRole changes the platform-level account role. Promoted administrators are
+// also made owners of the self-operated merchant for a consistent merchant context.
+func (s *UserService) UpdateRole(id uint, role string, actorUserID uint) error {
+	if id == 0 {
+		return errors.New("用户不存在")
+	}
+	if id == actorUserID {
+		return errors.New("不能修改当前登录账号的系统角色")
+	}
+	if role != model.RoleAdmin && role != model.RoleMerchant {
+		return errors.New("无效的账号角色")
+	}
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var user model.User
+		if err := tx.First(&user, id).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("用户不存在")
+			}
+			return err
+		}
+		if user.Role == role {
+			return nil
+		}
+		if user.Role == model.RoleAdmin && user.Status == 1 && role != model.RoleAdmin {
+			var admins int64
+			if err := tx.Model(&model.User{}).Where("role = ? AND status = ?", model.RoleAdmin, 1).Count(&admins).Error; err != nil {
+				return err
+			}
+			if admins <= 1 {
+				return errors.New("至少保留一个启用的平台管理员")
+			}
+		}
+		if err := tx.Model(&user).Update("role", role).Error; err != nil {
+			return err
+		}
+		if role != model.RoleAdmin {
+			return nil
+		}
+		var merchant model.Merchant
+		if err := tx.Where("code = ?", model.MerchantCodeSelfOperated).First(&merchant).Error; err != nil {
+			return err
+		}
+		member := model.MerchantMember{MerchantID: merchant.ID, UserID: user.ID, Role: model.MemberRoleOwner, Status: user.Status, IsDefault: true}
+		return tx.Clauses(clause.OnConflict{
+			Columns: []clause.Column{{Name: "merchant_id"}, {Name: "user_id"}},
+			DoUpdates: clause.Assignments(map[string]interface{}{
+				"role": model.MemberRoleOwner, "status": user.Status, "is_default": true,
+			}),
+		}).Create(&member).Error
+	})
+}
+
 // Delete removes a platform account and its merchant memberships. It protects the current
 // account and the final enabled platform administrator so the platform cannot be locked out.
 func (s *UserService) Delete(id, actorUserID uint) error {