重构：移除环境变量管理员初始化

backend/internal/service/auth.go

@@ -153,49 +153,3 @@ func (s *AuthService) UpdateCurrentAccount(userID uint, in UpdateCurrentAccountI
 	}
 	return updated, nil
 }
-
-// EnsureAdmin creates the first platform administrator for an empty database.
-// Existing administrator accounts are never changed by environment variables.
-func (s *AuthService) EnsureAdmin(username, password string) error {
-	var count int64
-	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
-	if count > 0 {
-		if s.tenant != nil {
-			var admins []model.User
-			if err := s.db.Where("role = ?", model.RoleAdmin).Find(&admins).Error; err != nil {
-				return err
-			}
-			for _, admin := range admins {
-				if err := s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status); err != nil {
-					return err
-				}
-			}
-		}
-		return nil
-	}
-	username = strings.TrimSpace(username)
-	if len(username) < 3 {
-		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_USERNAME（至少 3 位）")
-	}
-	if len(password) < 8 {
-		return errors.New("空数据库首次启动必须设置 INITIAL_ADMIN_PASSWORD（至少 8 位）")
-	}
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return err
-	}
-	admin := &model.User{
-		Username:     username,
-		PasswordHash: string(hash),
-		Nickname:     username,
-		Role:         model.RoleAdmin,
-		Status:       1,
-	}
-	if err := s.db.Create(admin).Error; err != nil {
-		return err
-	}
-	if s.tenant != nil {
-		return s.tenant.EnsureSelfMember(admin.ID, model.MemberRoleOwner, admin.Status)
-	}
-	return nil
-}

backend/internal/service/merchant_test.go

@@ -336,26 +336,3 @@ func TestListMerchantAccountGroupsExcludesPlatformAdmins(t *testing.T) {
 		t.Fatalf("unexpected merchant account group: %+v", groups[0])
 	}
 }
-
-func TestEnsureAdminUsesConfiguredCredentialsOnlyForEmptyDatabase(t *testing.T) {
-	db := newServiceTestDB(t)
-	tenant := NewTenantService(db)
-	auth := NewAuthService(db, nil, tenant)
-	if err := auth.EnsureAdmin("skin_nh_admin", "secure-password"); err != nil {
-		t.Fatalf("create configured admin: %v", err)
-	}
-	var created model.User
-	if err := db.Where("username = ?", "skin_nh_admin").First(&created).Error; err != nil {
-		t.Fatalf("configured admin should exist: %v", err)
-	}
-	if err := bcrypt.CompareHashAndPassword([]byte(created.PasswordHash), []byte("secure-password")); err != nil {
-		t.Fatalf("configured password should match: %v", err)
-	}
-	if err := auth.EnsureAdmin("replacement-admin", "another-password"); err != nil {
-		t.Fatalf("existing admin should not be replaced: %v", err)
-	}
-	var count int64
-	if err := db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count).Error; err != nil || count != 1 {
-		t.Fatalf("existing admin should remain unchanged, count=%d err=%v", count, err)
-	}
-}