feat: 支持注销用户并展示普通用户使用情况

- 新增管理员注销用户接口，要求输入用户名二次确认
- 注销时清理用户当前图片、视频、文件、标签、会话和自身日志
- 保留备份任务、管理员审计数据和全局配置
- 用户列表展示图片、视频、文件占用，管理员行隐藏使用情况和操作按钮
- 补充注销流程与用量统计测试

server/api/admin/users/[id]/delete.post.ts

@@ -0,0 +1,61 @@
+import { requireAdminAuth } from '../../../../utils/access'
+import { createApiError } from '../../../../utils/api-error'
+import { logActivity } from '../../../../utils/activity-log'
+import { findUserById } from '../../../../utils/db'
+import { deleteUserCurrentData } from '../../../../utils/user-storage'
+
+export default defineEventHandler(async (event) => {
+  const operator = await requireAdminAuth(event)
+
+  const id = Number(getRouterParam(event, 'id'))
+  const target = Number.isInteger(id) ? findUserById(id) : null
+  if (!target) {
+    createApiError(event, 'INVALID_REQUEST', '用户不存在', 404)
+  }
+  if (target.role === 'admin') {
+    createApiError(event, 'FORBIDDEN', '不允许注销管理员账号', 403)
+  }
+  if (target.id === operator.id) {
+    createApiError(event, 'INVALID_REQUEST', '不能注销当前登录账号', 400)
+  }
+
+  const body = await readBody<{ confirmation?: string }>(event).catch(() => null)
+  if (body?.confirmation?.trim() !== target.username) {
+    createApiError(event, 'INVALID_REQUEST', '请输入用户名确认注销', 400)
+  }
+
+  try {
+    const result = await deleteUserCurrentData(target.id)
+    if (result.failed.length) {
+      createApiError(
+        event,
+        'CONFLICT',
+        `有 ${result.failed.length} 个媒体删除失败，账号未注销，请重试`,
+        409
+      )
+    }
+
+    logActivity(event, {
+      action: 'delete',
+      key: `users/${target.id}`,
+      originalName: '已注销用户',
+      source: 'admin',
+      userId: operator.id
+    })
+
+    return { success: true, ...result }
+  } catch (error: unknown) {
+    if (error instanceof Error) {
+      if (error.message === 'USER_STORAGE_CLEAR_IN_PROGRESS') {
+        createApiError(event, 'CONFLICT', '用户数据正在清理，请勿重复操作', 409)
+      }
+      if (error.message === 'USER_STORAGE_CLEAR_ACTIVE_JOB') {
+        createApiError(event, 'CONFLICT', '该用户有正在运行的任务，请完成后再注销', 409)
+      }
+      if (error.message === 'ADMIN_USER_DELETE_FORBIDDEN') {
+        createApiError(event, 'FORBIDDEN', '不允许注销管理员账号', 403)
+      }
+    }
+    throw error
+  }
+})

server/api/admin/users/index.get.ts

@@ -1,7 +1,7 @@
 import { requireAdminAuth } from '../../../utils/access'
-import { listAdminUsers } from '../../../utils/db'
+import { listAdminUsersWithUsage } from '../../../utils/db'
 
 export default defineEventHandler(async (event) => {
   await requireAdminAuth(event)
-  return { users: listAdminUsers() }
+  return { users: listAdminUsersWithUsage() }
 })