fix: seed_admin() no longer resets admin password on restart

Remove hash verification + password reset logic. seed_admin() now
only creates the admin account if it does not exist. Prevents
password being reset to default + must_change_password flag
being set on every server restart.

app/core/auth.py

@@ -56,7 +56,7 @@ def decode_token(token: str) -> Optional[Dict[str, Any]]:
         return None
 
 def seed_admin():
-    """Seed default admin account on initial launch if not exists or update password hash if outdated."""
+    """Seed default admin account on initial launch only — never resets existing password."""
     conn = get_db_connection()
     cursor = conn.cursor()
     
@@ -64,9 +64,8 @@ def seed_admin():
     hashed_pwd = hash_password(default_pwd)
     now = time.time()
     
-    cursor.execute("SELECT id, hashed_password, must_change_password FROM users WHERE username = ?", ("admin",))
-    row = cursor.fetchone()
-    if not row:
+    cursor.execute("SELECT id FROM users WHERE username = ?", ("admin",))
+    if not cursor.fetchone():
         admin_id = str(uuid.uuid4())
         cursor.execute("""
         INSERT INTO users (id, username, email, hashed_password, role, must_change_password, created_at, is_active)
@@ -78,11 +77,6 @@ def seed_admin():
         VALUES (?, 10240, 64)
         """, (admin_id,))
         conn.commit()
-    else:
-        # Kiểm tra và sửa password admin mặc định nếu cần
-        if not verify_password(default_pwd, row["hashed_password"]):
-            cursor.execute("UPDATE users SET hashed_password = ?, must_change_password = 1 WHERE id = ?", (hashed_pwd, row["id"]))
-            conn.commit()
             
     conn.close()