重构：移除环境变量管理员初始化

backend/internal/config/config.go

@@ -14,9 +14,6 @@ type Config struct {
 	JWTSecret   string
 	DatabaseURL string
 	Mode        string // debug / release
-	// InitialAdminUsername 和 InitialAdminPassword 仅用于空数据库首次创建平台管理员。
-	InitialAdminUsername string
-	InitialAdminPassword string
 	// DataEncryptionKey 用于加密保存 API/回调密钥；为空时由 JWT_SECRET 派生。
 	DataEncryptionKey string
 	// OpenAPIKey 皮肤源头开放接口标识（Header: X-Api-Key，可公开给对接方）
@@ -70,8 +67,6 @@ func Load() *Config {
 		JWTSecret:                             getEnv("JWT_SECRET", "affiliate-dash-dev-secret-change-me"),
 		DatabaseURL:                           getEnv("DATABASE_URL", "postgres://affiliate:affiliate_dev_password@127.0.0.1:15432/affiliate_dash?sslmode=disable&TimeZone=Asia/Shanghai"),
 		Mode:                                  mode,
-		InitialAdminUsername:                  getEnv("INITIAL_ADMIN_USERNAME", ""),
-		InitialAdminPassword:                  getEnv("INITIAL_ADMIN_PASSWORD", ""),
 		DataEncryptionKey:                     getEnv("DATA_ENCRYPTION_KEY", getEnv("JWT_SECRET", "affiliate-dash-dev-secret-change-me")),
 		OpenAPIKey:                            getEnv("OPEN_API_KEY", "sk_source_dev_key_change_me"),
 		OpenAPISecret:                         getEnv("OPEN_API_SECRET", "sk_source_dev_secret_change_me"),

backend/internal/service/auth.go

@@ -153,49 +153,3 @@ func (s *AuthService) UpdateCurrentAccount(userID uint, in UpdateCurrentAccountI
 	}
 	return updated, nil
 }
-
-// EnsureAdmin creates the first platform administrator for an empty database.
-// Existing administrator accounts are never changed by environment variables.
-func (s *AuthService) EnsureAdmin(username, password string) error {
-	var count int64
-	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
-	if count > 0 {
-		if s.tenant != nil {
-			var admins []model.User
-			if err := s.db.Where("role = ?", model.RoleAdmin).Find(&admins).Error; err != nil {
-				return err
-			}
-			for _, admin := range admins {
-				if err := s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status); err != nil {
-					return err
-				}
-			}
-		}
-		return nil
-	}
-	username = strings.TrimSpace(username)
-	if len(username) < 3 {
-		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
-	}
-	if len(password) < 8 {
-		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
-	}
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return err
-	}
-	admin := &model.User{
-		Username:     username,
-		PasswordHash: string(hash),
-		Nickname:     username,
-		Role:         model.RoleAdmin,
-		Status:       1,
-	}
-	if err := s.db.Create(admin).Error; err != nil {
-		return err
-	}
-	if s.tenant != nil {
-		return s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status)
-	}
-	return nil
-}

backend/internal/service/merchant_test.go

@@ -336,26 +336,3 @@ func TestListMerchantAccountGroupsExcludesPlatformAdmins(t *testing.T) {
 		t.Fatalf("unexpected merchant account group: %+v", groups[0])
 	}
 }
-
-func TestEnsureAdminUsesConfiguredCredentialsOnlyForEmptyDatabase(t *testing.T) {
-	db := newServiceTestDB(t)
-	tenant := NewTenantService(db)
-	auth := NewAuthService(db, nil, tenant)
-	if err := auth.EnsureAdmin("skin_nh_admin", "secure-password"); err != nil {
-		t.Fatalf("create configured admin: %v", err)
-	}
-	var created model.User
-	if err := db.Where("username = ?", "skin_nh_admin").First(&created).Error; err != nil {
-		t.Fatalf("configured admin should exist: %v", err)
-	}
-	if err := bcrypt.CompareHashAndPassword([]byte(created.PasswordHash), []byte("secure-password")); err != nil {
-		t.Fatalf("configured password should match: %v", err)
-	}
-	if err := auth.EnsureAdmin("replacement-admin", "another-password"); err != nil {
-		t.Fatalf("existing admin should not be replaced: %v", err)
-	}
-	var count int64
-	if err := db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count).Error; err != nil || count != 1 {
-		t.Fatalf("existing admin should remain unchanged, count=%d err=%v", count, err)
-	}
-}