feat(admin,player,api): 玩家账号密码管理与代理上下分

新增玩家头像、可查密码与全局改密/改账号开关；玩家资料页合并账号密码展示；代理直属玩家列表支持自定义上下分。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/prisma/migrations/20260603120000_user_avatar_key/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable: user_preferences 增加头像（内置球员 key）
+ALTER TABLE "user_preferences" ADD COLUMN IF NOT EXISTS "avatar_key" VARCHAR(128);

apps/api/prisma/migrations/20260604120000_user_account_controls/migration.sql

@@ -0,0 +1,4 @@
+-- AlterTable: 玩家账号权限与后台可查密码
+ALTER TABLE "user_preferences" ADD COLUMN IF NOT EXISTS "allow_password_change" BOOLEAN NOT NULL DEFAULT true;
+ALTER TABLE "user_preferences" ADD COLUMN IF NOT EXISTS "allow_username_change" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "user_preferences" ADD COLUMN IF NOT EXISTS "managed_password" VARCHAR(128);

apps/api/prisma/schema.prisma

@@ -52,13 +52,17 @@ model UserAuth {
 }
 
 model UserPreference {
-  id        BigInt   @id @default(autoincrement())
-  userId    BigInt   @unique @map("user_id")
-  locale    String   @default("en-US") @db.VarChar(10)
-  phone     String?  @db.VarChar(32)
-  email     String?  @db.VarChar(128)
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
+  id                  BigInt   @id @default(autoincrement())
+  userId              BigInt   @unique @map("user_id")
+  locale              String   @default("en-US") @db.VarChar(10)
+  phone               String?  @db.VarChar(32)
+  email               String?  @db.VarChar(128)
+  avatarKey           String?  @map("avatar_key") @db.VarChar(128)
+  allowPasswordChange Boolean  @default(true) @map("allow_password_change")
+  allowUsernameChange Boolean  @default(false) @map("allow_username_change")
+  managedPassword     String?  @map("managed_password") @db.VarChar(128)
+  createdAt           DateTime @default(now()) @map("created_at")
+  updatedAt           DateTime @updatedAt @map("updated_at")
 
   user      User     @relation(fields: [userId], references: [id])
 

apps/api/prisma/seed.ts

@@ -579,7 +579,7 @@ async function main() {
       parentId: agent1.id,
       auth: { create: { passwordHash: playerHash } },
       wallet: { create: { availableBalance: 1000 } },
-      preferences: { create: { locale: 'zh-CN' } },
+      preferences: { create: { locale: 'zh-CN', managedPassword: 'Player@123' } },
     },
     update: {},
   });