feat: add admin web updates and verified username changes

Add isolated update jobs with database backups, progress logs and application rollback. Remove default account hints and prevent default admin recreation after renaming.

Enforce customer and order search scopes, secure session cookies, fix quotation rounding and amount wording, and update backend dependencies. Add API and deployment regression coverage.

backend/db/db.js

@@ -276,12 +276,12 @@ function ensureColumns() {
 
 ensureColumns();
 
-// 创建默认管理员账号（如果不存在）
+// 只为空库创建初始管理员；改名后重启不能重新生成默认账号。
 function createDefaultAdmin() {
   const crypto = require('crypto');
-  const adminExists = db.prepare('SELECT id FROM users WHERE username = ?').get('admin');
+  const existingUser = db.prepare('SELECT id FROM users LIMIT 1').get();
 
-  if (!adminExists) {
+  if (!existingUser) {
     // 生成默认密码哈希：admin123
     const salt = crypto.randomBytes(16).toString('hex');
     const hash = crypto.scryptSync('admin123', salt, 64).toString('hex');