fix: 12 issues - admin permission scope, player sidebar nav, SMTP label, user create servers

backend/routes/users.js

@@ -24,6 +24,7 @@ router.post('/', authenticate, requireRole('owner','admin'), async (req, res) =>
   const { username, password, email, game_name, game_uid, role, source } = req.body;
   if (!username||!password||!email||!game_name||!game_uid||!role) return res.status(400).json({ error: '所有字段必填' });
   if (!['owner','admin','player'].includes(role)) return res.status(400).json({ error: '无效角色' });
+  if (role === 'owner' && req.user.role !== 'owner') return res.status(403).json({ error: '仅服主可创建服主账号' });
   if (password.length < 6) return res.status(400).json({ error: '密码至少6位' });
   if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '用户名已存在' });
   const hashed = bcrypt.hashSync(password, 10);