Step 2：用户 CRUD + bcrypt + JWT 真实鉴权 + RBAC 依赖

backend/app/main.py

@@ -1,8 +1,26 @@
+from contextlib import asynccontextmanager
+
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.api.v1.router import api_router
 from app.core.config import settings
+from app.crud.user import ensure_admin_exists
+from app.db.base import Base
+from app.db.session import SessionLocal, engine
+
+
+@asynccontextmanager
+async def lifespan(_: FastAPI):
+    # Ensure models are imported so metadata is populated
+    from app.models import user as user_model  # noqa: F401
+
+    if settings.ENV == "development":
+        async with engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)
+        async with SessionLocal() as session:
+            await ensure_admin_exists(session)
+    yield
 
 
 def create_app() -> FastAPI:
@@ -10,6 +28,7 @@ def create_app() -> FastAPI:
         title="CTMS API",
         version="0.1.0",
         debug=settings.ENV == "development",
+        lifespan=lifespan,
     )
 
     app.add_middleware(