功能：优化账号分层与管理员初始化

backend/internal/service/auth.go

@@ -86,7 +86,9 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 	return s.db.Model(&user).Update("password_hash", string(hash)).Error
 }
 
-func (s *AuthService) EnsureAdmin() error {
+// EnsureAdmin creates the first platform administrator for an empty database.
+// Existing administrator accounts are never changed by environment variables.
+func (s *AuthService) EnsureAdmin(username, password string) error {
 	var count int64
 	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
 	if count > 0 {
@@ -103,14 +105,21 @@ func (s *AuthService) EnsureAdmin() error {
 		}
 		return nil
 	}
-	hash, err := bcrypt.GenerateFromPassword([]byte("admin123"), bcrypt.DefaultCost)
+	username = strings.TrimSpace(username)
+	if len(username) < 3 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
+	}
+	if len(password) < 8 {
+		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 	admin := &model.User{
-		Username:     "admin",
+		Username:     username,
 		PasswordHash: string(hash),
-		Nickname:     "管理员",
+		Nickname:     username,
 		Role:         model.RoleAdmin,
 		Status:       1,
 	}