feat(ECR-006): 落地运营后台 Phase A（admin API + admin-h5）

新增独立鉴权的 /api/v1/admin 与 Vue 控制台；会员授予与审计同事务，并补集成/单测。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/httpserver/router.go

@@ -2,6 +2,9 @@
 package httpserver
 
 import (
+	"context"
+	"log"
+
 	"github.com/gin-gonic/gin"
 	"github.com/jackc/pgx/v5/pgxpool"
 
@@ -10,6 +13,7 @@ import (
 	"github.com/yuxingu/digital-psychology/apps/api/internal/llm/deepseek"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+	adminsvc "github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/service/ask"
 	companionsvc "github.com/yuxingu/digital-psychology/apps/api/internal/service/companion"
 	imagecardsvc "github.com/yuxingu/digital-psychology/apps/api/internal/service/imagecard"
@@ -27,6 +31,7 @@ func NewRouter(pool *pgxpool.Pool, cfg config.Config) *gin.Engine {
 	reportRepo := &repository.ReportRepo{Pool: pool}
 	relationRepo := &repository.RelationRepo{Pool: pool}
 	askRepo := &repository.AskRepo{Pool: pool}
+	adminRepo := &repository.AdminRepo{Pool: pool}
 
 	var llm *deepseek.Client
 	if cfg.DeepSeek.Enabled() {
@@ -49,6 +54,13 @@ func NewRouter(pool *pgxpool.Pool, cfg config.Config) *gin.Engine {
 		Reports:  reportRepo,
 		Quotas:   &repository.ImageCardRepo{Pool: pool},
 	}
+	adminSvc := &adminsvc.Service{Repo: adminRepo, Reports: reportRepo}
+	if err := adminSvc.EnsureBootstrap(context.Background(), adminsvc.BootstrapConfig{
+		Username: cfg.Admin.BootstrapUsername,
+		Password: cfg.Admin.BootstrapPassword,
+	}); err != nil {
+		log.Printf("admin bootstrap failed: %v", err)
+	}
 
 	r := gin.New()
 	r.Use(gin.Recovery(), gin.Logger(), middleware.RequestID())
@@ -62,6 +74,7 @@ func NewRouter(pool *pgxpool.Pool, cfg config.Config) *gin.Engine {
 	api.GET("/ping", func(c *gin.Context) {
 		response.OK(c, gin.H{"pong": true})
 	})
+	(&handler.AdminHandler{Svc: adminSvc}).Register(api)
 
 	authed := api.Group("")
 	authed.Use(middleware.DeviceAuth(pool))