添加默认系统管理员账号并限制唯一

backend/internal/handlers/admin.go

@@ -161,6 +161,10 @@ func (h *AdminHandler) UpdateUser(c *gin.Context) {
 	}
 
 	if req.Status != "" {
+		if target.Role.NameEnum() == models.RoleSystemAdmin && req.Status != "active" {
+			c.JSON(http.StatusForbidden, gin.H{"success": false, "error": "不能禁用系统管理员账号"})
+			return
+		}
 		updates["status"] = req.Status
 	}
 
@@ -170,6 +174,10 @@ func (h *AdminHandler) UpdateUser(c *gin.Context) {
 			c.JSON(http.StatusBadRequest, gin.H{"success": false, "error": "无效的角色"})
 			return
 		}
+		if target.Role.NameEnum() == models.RoleSystemAdmin && newRole != models.RoleSystemAdmin {
+			c.JSON(http.StatusForbidden, gin.H{"success": false, "error": "不能修改系统管理员账号的角色"})
+			return
+		}
 		if !containsRole(allowedRolesForCreation(current.Role), newRole) || !current.Role.CanManage(newRole) {
 			c.JSON(http.StatusForbidden, gin.H{"success": false, "error": "权限不足"})
 			return
@@ -211,6 +219,11 @@ func (h *AdminHandler) DeleteUser(c *gin.Context) {
 		return
 	}
 
+	if target.Role.NameEnum() == models.RoleSystemAdmin {
+		c.JSON(http.StatusForbidden, gin.H{"success": false, "error": "不能删除系统管理员账号"})
+		return
+	}
+
 	if err := h.DB.Delete(&target).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"success": false, "error": "internal server error"})
 		return