fix: 安装时创建管理员用户，登录从数据库验证

internal/database/database.go

@@ -62,8 +62,8 @@ func Close() error {
 	return nil
 }
 
-// 确保 admin 用户存在
-func EnsureAdminUser() error {
+// 确保 admin 用户存在（仅在安装时调用）
+func EnsureAdminUser(username, password string) error {
 	var count int64
 	DB.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&count)
 	if count > 0 {
@@ -71,8 +71,8 @@ func EnsureAdminUser() error {
 	}
 
 	admin := &model.User{
-		Username:       "admin",
-		HashedPassword: HashPassword("admin"),
+		Username:       username,
+		HashedPassword: HashPassword(password),
 		Role:           model.RoleAdmin,
 		Balance:        1000000,
 	}
@@ -80,6 +80,20 @@ func EnsureAdminUser() error {
 	return DB.Create(admin).Error
 }
 
+// 验证用户登录
+func ValidateUser(username, password string) (*model.User, error) {
+	var user model.User
+	if err := DB.Where("username = ?", username).First(&user).Error; err != nil {
+		return nil, err
+	}
+
+	if user.HashedPassword != password {
+		return nil, fmt.Errorf("密码错误")
+	}
+
+	return &user, nil
+}
+
 func HashPassword(password string) string {
 	// 简化处理，实际应使用 bcrypt
 	// 后续补充完整实现

internal/handler/captcha.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"anticaptcha/internal/captcha"
+	"anticaptcha/internal/database"
 	"anticaptcha/internal/middleware"
 	"anticaptcha/internal/model"
 
@@ -86,24 +87,25 @@ func (h *CaptchaHandler) Login(c *gin.Context) {
 		return
 	}
 
-	// TODO: 验证用户密码
-	if req.Username == "admin" && req.Password == "admin" {
-		token, err := middleware.GenerateToken(1, "admin", "admin")
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "生成令牌失败"})
-			return
-		}
-
-		c.JSON(http.StatusOK, model.LoginResponse{
-			AccessToken: token,
-			TokenType:   "bearer",
-			Role:        "admin",
-			Balance:     1000000,
-		})
+	// 从数据库验证用户
+	user, err := database.ValidateUser(req.Username, req.Password)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "用户名或密码错误"})
 		return
 	}
 
-	c.JSON(http.StatusUnauthorized, gin.H{"error": "用户名或密码错误"})
+	token, err := middleware.GenerateToken(int(user.ID), user.Username, string(user.Role))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "生成令牌失败"})
+		return
+	}
+
+	c.JSON(http.StatusOK, model.LoginResponse{
+		AccessToken: token,
+		TokenType:   "bearer",
+		Role:        string(user.Role),
+		Balance:     user.Balance,
+	})
 }
 
 // 验证令牌