feat(ECR-006): 落地运营后台 Phase A（admin API + admin-h5）

新增独立鉴权的 /api/v1/admin 与 Vue 控制台；会员授予与审计同事务，并补集成/单测。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/config/config.go

@@ -18,6 +18,13 @@ type Config struct {
 	DatabaseURL string
 	AppEnv      string
 	DeepSeek    DeepSeekConfig
+	Admin       AdminConfig
+}
+
+// AdminConfig for ops console bootstrap (ECR-006).
+type AdminConfig struct {
+	BootstrapUsername string
+	BootstrapPassword string
 }
 
 // DeepSeekConfig for Ask LLM.
@@ -47,6 +54,10 @@ type fileConfig struct {
 		Model      string `yaml:"model"`
 		TimeoutSec int    `yaml:"timeout_sec"`
 	} `yaml:"deepseek"`
+	Admin struct {
+		BootstrapUsername string `yaml:"bootstrap_username"`
+		BootstrapPassword string `yaml:"bootstrap_password"`
+	} `yaml:"admin"`
 }
 
 // Load reads config.local.yaml (or CONFIG_PATH), then applies env overrides.
@@ -123,6 +134,12 @@ func mergeFile(cfg *Config, path string) error {
 	if f.DeepSeek.TimeoutSec > 0 {
 		cfg.DeepSeek.TimeoutSec = f.DeepSeek.TimeoutSec
 	}
+	if f.Admin.BootstrapUsername != "" {
+		cfg.Admin.BootstrapUsername = f.Admin.BootstrapUsername
+	}
+	if f.Admin.BootstrapPassword != "" {
+		cfg.Admin.BootstrapPassword = f.Admin.BootstrapPassword
+	}
 	return nil
 }
 
@@ -184,6 +201,12 @@ func applyEnv(cfg *Config) {
 			cfg.DeepSeek.TimeoutSec = n
 		}
 	}
+	if v := os.Getenv("ADMIN_BOOTSTRAP_USERNAME"); v != "" {
+		cfg.Admin.BootstrapUsername = v
+	}
+	if v := os.Getenv("ADMIN_BOOTSTRAP_PASSWORD"); v != "" {
+		cfg.Admin.BootstrapPassword = v
+	}
 }
 
 // Enabled reports whether DeepSeek can be called.