feat: 统一生产初始化流程并保护系统管理员

backend/app/crud/user.py

@@ -4,6 +4,12 @@ from typing import Sequence
 from sqlalchemy import delete, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.core.config import (
+    PROTECTED_ADMIN_DEFAULT_PASSWORD,
+    PROTECTED_ADMIN_DEPARTMENT,
+    PROTECTED_ADMIN_EMAIL,
+    PROTECTED_ADMIN_FULL_NAME,
+)
 from app.core.security import hash_password
 from app.models.study_member import StudyMember
 from app.models.user import User, UserRole, UserStatus
@@ -15,6 +21,14 @@ async def get_by_email(db: AsyncSession, email: str) -> User | None:
     return result.scalar_one_or_none()
 
 
+def is_protected_admin_email(email: str | None) -> bool:
+    return (email or "").strip().lower() == PROTECTED_ADMIN_EMAIL
+
+
+def is_protected_admin_user(user: User | None) -> bool:
+    return user is not None and is_protected_admin_email(user.email)
+
+
 async def get_by_id(db: AsyncSession, user_id: uuid.UUID) -> User | None:
     result = await db.execute(select(User).where(User.id == user_id))
     return result.scalar_one_or_none()
@@ -90,17 +104,17 @@ async def list_users_by_status(
     return result.scalars().all()
 
 
-async def ensure_admin_exists(db: AsyncSession, *, default_password: str = "admin123") -> None:
-    result = await db.execute(select(User).where(User.role == UserRole.ADMIN))
+async def ensure_admin_exists(db: AsyncSession, *, default_password: str = PROTECTED_ADMIN_DEFAULT_PASSWORD) -> None:
+    result = await db.execute(select(User).where(User.email == PROTECTED_ADMIN_EMAIL))
     admin = result.scalar_one_or_none()
     if admin:
         return
     new_admin = User(
-        email="admin@example.com",
+        email=PROTECTED_ADMIN_EMAIL,
         password_hash=hash_password(default_password),
-        full_name="System Admin",
+        full_name=PROTECTED_ADMIN_FULL_NAME,
         role=UserRole.ADMIN,
-        department="SYSTEM",
+        department=PROTECTED_ADMIN_DEPARTMENT,
         status=UserStatus.ACTIVE,
     )
     db.add(new_admin)