feat: add onboarding setup flow with nickname and password

Replace default auto-generated password with a first-run setup page that
lets users choose their own nickname and password. The /auth/setup endpoint
now accepts an optional nickname field (also sets site_name). Remove
set_default_password() since setup is now mandatory before login.

api/app/utils/auth.py

@@ -1,15 +1,11 @@
 from datetime import datetime, timedelta, timezone
 from typing import Optional
-import secrets
 
 import bcrypt
 from jose import JWTError, jwt
 from fastapi import Request, HTTPException
-from sqlalchemy.orm import Session
 
 from app.config import JWT_SECRET, ACCESS_TOKEN_EXPIRE_MINUTES
-from app.models.user_settings import UserSettings
-from app.utils.logger import logger
 
 ALGORITHM = "HS256"
 
@@ -42,14 +38,3 @@ def get_current_user(request: Request) -> dict:
         return payload
     except JWTError:
         raise HTTPException(status_code=401, detail="登录已过期，请重新登录")
-
-
-def set_default_password(db: Session, settings: UserSettings):
-    if not settings.password_hash:
-        password = secrets.token_urlsafe(8)[:8]
-        settings.password_hash = hash_password(password)
-        db.commit()
-        logger.warning("=" * 50)
-        logger.warning(f"  初始密码: {password}")
-        logger.warning("  请登录后立即修改！")
-        logger.warning("=" * 50)