feat(admin,player,api): 玩家账号密码管理与代理上下分

新增玩家头像、可查密码与全局改密/改账号开关；玩家资料页合并账号密码展示；代理直属玩家列表支持自定义上下分。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/player/src/components/UserAvatarMenu.vue

@@ -1,17 +1,25 @@
 <script setup lang="ts">
-import { ref, computed } from 'vue';
+import { ref, computed, onMounted } from 'vue';
 import { useRouter } from 'vue-router';
 import { useI18n } from 'vue-i18n';
+import { playerAvatarUrl, randomAvatarKey } from '@thebet365/shared';
 import { useAuthStore } from '../stores/auth';
+import { usePlayerProfile } from '../composables/usePlayerProfile';
 
 const { t } = useI18n();
 const auth = useAuthStore();
 const router = useRouter();
+const { avatarUrl, loadProfile } = usePlayerProfile();
 const open = ref(false);
 
-const initial = computed(() => {
-  const name = auth.user?.username ?? '?';
-  return name.charAt(0).toUpperCase();
+const displayAvatarUrl = computed(() => {
+  if (avatarUrl.value) return avatarUrl.value;
+  const seed = auth.user?.username;
+  return seed ? playerAvatarUrl(randomAvatarKey(seed)) : null;
+});
+
+onMounted(() => {
+  void loadProfile();
 });
 
 function toggle() {
@@ -37,7 +45,7 @@ function logout() {
 <template>
   <div class="avatar-wrap">
     <button type="button" class="avatar-btn" :aria-expanded="open" @click="toggle">
-      <span class="avatar-letter">{{ initial }}</span>
+      <img v-if="displayAvatarUrl" :src="displayAvatarUrl" alt="" class="avatar-img" />
     </button>
 
     <div v-if="open" class="avatar-menu">
@@ -68,6 +76,15 @@ function logout() {
   justify-content: center;
   cursor: pointer;
   flex-shrink: 0;
+  overflow: hidden;
+  padding: 0;
+}
+
+.avatar-img {
+  width: 100%;
+  height: 100%;
+  object-fit: cover;
+  object-position: top;
 }
 
 .avatar-letter {