feat: add system admin account management with RBAC

- AdminUser model: multi-admin accounts with bcrypt hashing (admin_users table)
- Three roles: superadmin / admin / viewer with granular permission bits
- auth.py: login migrated from env-var single admin to DB-backed accounts;
  seed_initial_admin() auto-creates first superadmin from SM_ADMIN_PASSWORD
- Web UI: /system/admins page (add/edit role/toggle/reset pwd/delete)
  + change-my-password; sidebar entry; permission-guarded routes
- REST API: /api/admins CRUD with protection checks
- Protections: cannot delete/disable self; keep >=1 enabled superadmin;
  disabled accounts fail permission checks immediately
- README: document roles, permission bits, API

templates/base.html

@@ -217,6 +217,8 @@ canvas { max-width:100%; }
     <div class="sidebar-section">系统</div>
     <a class="nav-link {% if nav.system %}active{% endif %}" href="/system">
       <i class="bi bi-shield-lock"></i> 系统管理</a>
+    <a class="nav-link {% if nav.admins %}active{% endif %}" href="/system/admins">
+      <i class="bi bi-person-gear"></i> 管理员账户</a>
   </div>
 </div>