chore: pure-random 32-char secret, no default source, legacy migration

- genSecret: drop SeaReport- prefix, plain 32-char random hex
- users.source: no default anywhere (register/admin/external), ADD COLUMN
  migration now VARCHAR DEFAULT '' (was ENUM netease default)
- legacy upgrade path kept: ENUM->VARCHAR MODIFY + user_identities MODIFY
  + sources seeded netease/skin idempotently
- docs updated (credential format, no prefix)

docs/EXTERNAL-API.md

@@ -14,7 +14,7 @@
 
 ```text
 Client ID: 1829473056482917          # 16 位纯数字, 随机生成
-Secret:    SeaReport-a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4   # SeaReport- + 32 位
+Secret:    a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6   # 32 位全随机字符串
 ```
 
 > ⚠️ Secret 只在创建时显示一次,请立即保存。支持创建多个客户端、单独停用/删除,互不影响。
@@ -70,7 +70,7 @@ BASE = "https://你的域名/api/external"
 # 1) 用 ID + Secret 换取 SESSION
 r = requests.post(f"{BASE}/auth/session", headers={
     "x-api-client-id": "1829473056482917",
-    "x-api-secret": "SeaReport-a1b2c3d4...",
+    "x-api-secret": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
 })
 session = r.json()["session_token"]
 HEADERS = {"Authorization": f"Bearer {session}", "Content-Type": "application/json"}
@@ -96,7 +96,7 @@ const BASE = 'https://你的域名/api/external';
 // 1) 换取 SESSION
 const authRes = await fetch(`${BASE}/auth/session`, {
   method: 'POST',
-  headers: { 'x-api-client-id': '1829473056482917', 'x-api-secret': 'SeaReport-a1b2c3d4...' },
+  headers: { 'x-api-client-id': '1829473056482917', 'x-api-secret': 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6' },
 });
 const { session_token } = await authRes.json();
 const H = { Authorization: `Bearer ${session_token}`, 'Content-Type': 'application/json' };