feat: 单 owner 认证模型 — 替换注册为一次性设置向导 + Recovery Key + CLI 密码重置

自托管 Life OS 不应有公开注册。改为：
- /setup 一次性初始化向导（创建唯一 owner + 生成 Recovery Key）
- /recover 通过 Recovery Key 重置密码
- /login 未初始化时重定向到 /setup，去掉注册链接
- Better Auth databaseHooks 阻止额外用户注册
- citty CLI: bun run cli auth reset-password
- 删除 /signup 路由
- 新增 system_settings 表存储 recovery key hash
- 修复 drizzle.config.ts 非空断言 + sidebar.tsx cookieStore API
- 更新 AGENTS.md shadcn/ui 组件编辑规则

apps/server/package.json

@@ -5,6 +5,7 @@
   "type": "module",
   "scripts": {
     "build": "bunx --bun vite build",
+    "cli": "bun run src/cli/index.ts",
     "compile": "bun compile.ts",
     "compile:darwin": "bun run compile:darwin:arm64 && bun run compile:darwin:x64",
     "compile:darwin:arm64": "bun compile.ts --target bun-darwin-arm64",
@@ -36,11 +37,12 @@
     "@orpc/zod": "catalog:",
     "@t3-oss/env-core": "catalog:",
     "@tanstack/react-query": "catalog:",
-    "@tanstack/react-virtual": "catalog:",
     "@tanstack/react-router": "catalog:",
     "@tanstack/react-router-ssr-query": "catalog:",
     "@tanstack/react-start": "catalog:",
+    "@tanstack/react-virtual": "catalog:",
     "better-auth": "catalog:",
+    "citty": "catalog:",
     "class-variance-authority": "catalog:",
     "clsx": "catalog:",
     "drizzle-orm": "catalog:",