修复：软删除账号可复用用户名

backend/internal/database/migrations/009_users_username_active_unique.sql

@@ -0,0 +1,3 @@
+-- Soft-deleted accounts must not permanently reserve their login usernames.
+DROP INDEX IF EXISTS idx_users_username;
+CREATE UNIQUE INDEX idx_users_username ON users (username) WHERE deleted_at IS NULL;

backend/internal/model/models.go

@@ -19,7 +19,9 @@ type User struct {
 	UpdatedAt time.Time      `json:"updated_at"`
 	DeletedAt gorm.DeletedAt `gorm:"index" json:"-"`
 
-	Username     string `gorm:"uniqueIndex;size:64;not null" json:"username"`
+	// Username uniqueness is enforced by a partial database index for active
+	// accounts, allowing a username to be reused after its old account is soft deleted.
+	Username     string `gorm:"size:64;not null" json:"username"`
 	PasswordHash string `gorm:"size:255;not null" json:"-"`
 	Nickname     string `gorm:"size:64" json:"nickname"`
 	Role         string `gorm:"size:32;not null;default:merchant" json:"role"`

backend/internal/service/merchant_test.go

@@ -373,3 +373,26 @@ func TestDeleteMerchantAccountRemovesAllMemberships(t *testing.T) {
 		t.Fatal("platform administrator should not be deletable from merchant account endpoint")
 	}
 }
+
+func TestUsernameCanBeReusedAfterMerchantAccountSoftDelete(t *testing.T) {
+	db := newServiceTestDB(t)
+	svc := NewUserService(db, nil)
+	admin := model.User{Username: "reuse-account-admin", PasswordHash: "hash", Role: model.RoleAdmin, Status: 1}
+	if err := db.Create(&admin).Error; err != nil {
+		t.Fatalf("create admin: %v", err)
+	}
+	account, err := svc.Create("reusable-username", "password123", "旧账号", model.RoleMerchant, 0)
+	if err != nil {
+		t.Fatalf("create merchant account: %v", err)
+	}
+	if err := svc.DeleteMerchantAccount(account.ID, admin.ID); err != nil {
+		t.Fatalf("soft delete merchant account: %v", err)
+	}
+	recreated, err := svc.Create("reusable-username", "password123", "新账号", model.RoleMerchant, 0)
+	if err != nil {
+		t.Fatalf("recreate account with soft-deleted username: %v", err)
+	}
+	if recreated.ID == account.ID {
+		t.Fatalf("expected a new account record, got id=%d", recreated.ID)
+	}
+}