上线版: 产品表单统一+form嵌套修复+用户管理+部署+三套叙事

- 产品编辑入口统一走 ProductFormFull(卖点/风格/人群/品牌词全字段);
  修复开任务页 <form> 套 <form> 致"编辑产品"报错、改不了、跳回首个产品
- dashboard 入口卡片对齐实际路由: 系统管理(/config) 与 工作配置(/settings) 分开;
  settings ?tab=products 直达改用挂载后读 URL, 消除 hydration mismatch
- 新增用户管理(users API/admin service/改密页) + alembic 022/023/024
- 上线部署: Dockerfile / docker-compose.prod+https / nginx https / .env.example
- A8 三套正交叙事(痛点/场景/成分背书) + beige 调色去AI化 + 飞轮 text_import 高权重信号

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/services/auth_service.py

@@ -9,6 +9,7 @@ import logging
 from passlib.context import CryptContext
 from sqlalchemy.orm import Session
 
+from app.core.config import get_settings
 from app.core.response import raise_unauthorized
 from app.middleware.workspace_guard import CurrentUser
 from app.models.user import User
@@ -16,6 +17,7 @@ from app.models.workspace import WorkspaceMember
 
 logger = logging.getLogger(__name__)
 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+DEFAULT_SEED_PASSWORD = "Clover2026!"
 
 
 def hash_password(plain: str) -> str:
@@ -38,6 +40,8 @@ def authenticate_user(
     ).first()
     if not user or not verify_password(password, user.hashed_password):
         raise_unauthorized("用户名或密码错误")
+    if get_settings().APP_ENV == "production" and password == DEFAULT_SEED_PASSWORD:
+        raise_unauthorized("默认密码已禁用，请联系管理员重置密码")
 
     # 取用户所在的第一个 workspace（手动建账号场景只有一个）
     member = (
@@ -68,4 +72,20 @@ def build_user_response(user: User, workspace_id: int, role: str) -> dict:
         "email": user.email,
         "current_workspace_id": workspace_id,
         "role": role,
+        "must_change_password": bool(getattr(user, "must_change_password", False)),
     }
+
+
+def change_password(db: Session, user_id: int, current_password: str, new_password: str) -> None:
+    user = db.query(User).filter(User.id == user_id, User.is_active == True).first()
+    if not user or not verify_password(current_password, user.hashed_password):
+        raise_unauthorized("当前密码错误")
+    if len(new_password) < 8:
+        from app.core.response import raise_param_error
+        raise_param_error("新密码至少 8 位")
+    if new_password == DEFAULT_SEED_PASSWORD:
+        from app.core.response import raise_param_error
+        raise_param_error("不能使用默认密码")
+    user.hashed_password = hash_password(new_password)
+    user.must_change_password = False
+    db.commit()