上线版: 产品表单统一+form嵌套修复+用户管理+部署+三套叙事

- 产品编辑入口统一走 ProductFormFull(卖点/风格/人群/品牌词全字段);
  修复开任务页 <form> 套 <form> 致"编辑产品"报错、改不了、跳回首个产品
- dashboard 入口卡片对齐实际路由: 系统管理(/config) 与 工作配置(/settings) 分开;
  settings ?tab=products 直达改用挂载后读 URL, 消除 hydration mismatch
- 新增用户管理(users API/admin service/改密页) + alembic 022/023/024
- 上线部署: Dockerfile / docker-compose.prod+https / nginx https / .env.example
- A8 三套正交叙事(痛点/场景/成分背书) + beige 调色去AI化 + 飞轮 text_import 高权重信号

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api/v1/auth.py

@@ -34,6 +34,11 @@ class LoginRequest(BaseModel):
         return v
 
 
+class ChangePasswordRequest(BaseModel):
+    current_password: str
+    new_password: str
+
+
 # ── 路由 ───────────────────────────────────────────────────
 @router.post("/login")
 def login(body: LoginRequest, db: Session = Depends(get_db)):
@@ -47,6 +52,18 @@ def login(body: LoginRequest, db: Session = Depends(get_db)):
     })
 
 
+@router.post("/change-password")
+def change_password(
+    body: ChangePasswordRequest,
+    current_user: Annotated[CurrentUser, Depends(get_current_user)],
+    db: Session = Depends(get_db),
+):
+    """修改当前登录用户密码；首登强制改密也走此接口。"""
+    from app.services.auth_service import change_password as do_change_password
+    do_change_password(db, current_user.user_id, body.current_password, body.new_password)
+    return ok({"changed": True})
+
+
 @router.get("/me")
 def get_me(
     current_user: Annotated[CurrentUser, Depends(get_current_user)],
@@ -63,6 +80,7 @@ def get_me(
         "email": user.email,
         "current_workspace_id": current_user.workspace_id,
         "role": current_user.role,
+        "must_change_password": bool(getattr(user, "must_change_password", False)),
         "workspace": {
             "id": ws.id, "name": ws.name, "slug": ws.slug,
         } if ws else None,