feat: 单 owner 认证模型 — 替换注册为一次性设置向导 + Recovery Key + CLI 密码重置

自托管 Life OS 不应有公开注册。改为：
- /setup 一次性初始化向导（创建唯一 owner + 生成 Recovery Key）
- /recover 通过 Recovery Key 重置密码
- /login 未初始化时重定向到 /setup，去掉注册链接
- Better Auth databaseHooks 阻止额外用户注册
- citty CLI: bun run cli auth reset-password
- 删除 /signup 路由
- 新增 system_settings 表存储 recovery key hash
- 修复 drizzle.config.ts 非空断言 + sidebar.tsx cookieStore API
- 更新 AGENTS.md shadcn/ui 组件编辑规则

apps/server/AGENTS.md

@@ -55,7 +55,7 @@ src/
 │   ├── AdminSidebar.tsx       # Admin sidebar (reads module registry)
 │   ├── Error.tsx              # Error boundary fallback
 │   ├── NotFound.tsx           # 404 fallback
-│   └── ui/                    # shadcn/ui components (DO NOT manually edit)
+│   └── ui/                    # shadcn/ui components (可自由修改，添加新组件用 bunx shadcn@latest add)
 ├── hooks/
 │   └── use-mobile.ts
 ├── lib/
@@ -286,7 +286,7 @@ export const relations = defineRelations(schema, (r) => ({
 - Use `useState` callback ref for virtualizer scroll elements inside Dialogs
 
 **DON'T:**
-- Manually edit `src/components/ui/*.tsx` (use `bunx shadcn@latest add`)
+- Add new `src/components/ui/*.tsx` without CLI (use `bunx shadcn@latest add` to scaffold, then freely customize)
 - Edit `src/routeTree.gen.ts` (auto-generated)
 - Use `asChild` prop (base-ui uses `render`, NOT Radix)
 - Import from `drizzle-zod` (use `drizzle-orm/zod`)