fix(deploy): 限制初始管理员密码长度

scripts/Initialize-SecurityEnv.ps1

@@ -9,6 +9,17 @@ function New-SecuritySecret {
     return [Convert]::ToBase64String($bytes)
 }
 
+function New-InitialAdminPassword {
+    $bytes = New-Object byte[] 10
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try {
+        $rng.GetBytes($bytes)
+    } finally {
+        $rng.Dispose()
+    }
+    return ([BitConverter]::ToString($bytes) -replace "-", "").ToLowerInvariant()
+}
+
 function Get-EnvValue {
     param([string]$Content, [string]$Key)
     $match = [regex]::Match($Content, "(?m)^$([regex]::Escape($Key))=(.*)$")
@@ -52,8 +63,7 @@ function Initialize-SecurityEnv {
             @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 },
             @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 },
             @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 },
-            @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 },
-            @{ Key = "CONFIG_INITIAL_ADMIN_PASSWORD"; Legacy = ""; MinLength = 12 }
+            @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 }
         )
     }
 
@@ -66,6 +76,14 @@ function Initialize-SecurityEnv {
         Write-Host "   [OK] Initialized security secret: $($definition.Key)" -ForegroundColor Green
     }
 
+    if ($Mode -eq "new") {
+        $adminPassword = Get-EnvValue $content "CONFIG_INITIAL_ADMIN_PASSWORD"
+        if ($adminPassword.Length -lt 12) {
+            $content = Set-EnvValue $content "CONFIG_INITIAL_ADMIN_PASSWORD" (New-InitialAdminPassword)
+            Write-Host "   [OK] Initialized admin password: CONFIG_INITIAL_ADMIN_PASSWORD" -ForegroundColor Green
+        }
+    }
+
     [System.IO.File]::WriteAllText(
         (Resolve-Path $Path),
         $content,