feat: add system admin account management with RBAC

- AdminUser model: multi-admin accounts with bcrypt hashing (admin_users table)
- Three roles: superadmin / admin / viewer with granular permission bits
- auth.py: login migrated from env-var single admin to DB-backed accounts;
  seed_initial_admin() auto-creates first superadmin from SM_ADMIN_PASSWORD
- Web UI: /system/admins page (add/edit role/toggle/reset pwd/delete)
  + change-my-password; sidebar entry; permission-guarded routes
- REST API: /api/admins CRUD with protection checks
- Protections: cannot delete/disable self; keep >=1 enabled superadmin;
  disabled accounts fail permission checks immediately
- README: document roles, permission bits, API

app.py

@@ -78,10 +78,6 @@ log = logging.getLogger("socks.app")
 
 
 def create_app():
-    # 确保密码已设置（首次启动自动设置默认密码）
-    from auth import get_or_set_password
-    get_or_set_password()
-
     app = Flask(__name__)
     app.config.from_object(Config)
     app.config["SECRET_KEY"] = os.environ.get(
@@ -100,9 +96,12 @@ def create_app():
     db.init_app(app)
     app.db = db
 
-    # 全局服务注册
+    # 建表 + 种子数据（必须在 app_context 中）
     with app.app_context():
         db.create_all()
+        # 种子初始管理员
+        from auth import seed_initial_admin
+        seed_initial_admin()
         # 初始化全局 db.app
         from database import db as _db
         _db.app = app