限制初始密码强制范围并修复后台图片加载

backend/internal/modules/adminauth/repository.go

@@ -133,6 +133,13 @@ func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminDTO, error)
 	return &dto, nil
 }
 
+func (r *Repository) FindActiveForPasswordGate(ctx context.Context, id uint64, tokenVersion int64) (*AdminDTO, error) {
+	if _, err := r.FindActiveForToken(ctx, id, tokenVersion); err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, id)
+}
+
 func (r *Repository) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {
 	if r.db == nil {
 		return ErrDependencyUnavailable
@@ -168,6 +175,7 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 		Where("aur.admin_user_id = ?", dto.ID).
 		Find(&roles)
 	dto.Roles = roles
+	dto.PasswordMustChange = dto.PasswordMustChange && rolesRequireInitialPasswordChange(roles)
 
 	// 加载权限
 	for _, role := range roles {
@@ -191,6 +199,15 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 	cachePermissions(ctx, r, dto.ID, permCodes)
 }
 
+func rolesRequireInitialPasswordChange(roles []RoleDTO) bool {
+	for _, role := range roles {
+		if role.Code == "super_admin" {
+			return true
+		}
+	}
+	return false
+}
+
 func cachePermissions(ctx context.Context, r *Repository, adminID uint64, permCodes []string) {
 	if r.redis == nil || len(permCodes) == 0 {
 		return