feat: game UID fully internal + remove multi-identity copy

- game_uid is now an internal param: auto-generated server-side
  (U + 12 hex) on register/bind-identity/install/admin-create/external
  register; player-supplied game_uid ignored
- Removed all player-facing UID inputs: register page, install page,
  identity bind modal, ticket-create 'your UID' field
- Removed player-facing UID display: identity table column,
  ticket detail/tracking reporter UID
- Removed '同一账号可绑定网易端 + 皮肤站身份' / '可绑定多个来源身份' copy
- Kept target_game_uid (reported player) and admin panel UID management
- settings-page skin-site placeholder updated

backend/routes/auth.js

@@ -118,13 +118,15 @@ router.post('/register', validateLengths({
     } catch {}
 
     const hashed = await bcrypt.hash(password, 10);
+    // 游戏UID为内置参数: 不接收玩家输入, 由系统自动生成
+    const builtinUid = 'U' + uuid().replace(/-/g, '').slice(0, 12).toUpperCase();
     const r = await query(
       'INSERT INTO users(username, password, email, game_name, game_uid, active, email_verified, source) VALUES (?,?,?,?,?,?,?,?)',
-      [username, hashed, email, game_name, game_uid||'', 1, 1, source || '']
+      [username, hashed, email, game_name, builtinUid, 1, 1, source || '']
     );
     try {
       await query('INSERT INTO user_identities(user_id, source, game_name, game_uid) VALUES (?,?,?,?)',
-        [r.insertId, source || '', game_name, game_uid || '']);
+        [r.insertId, source || '', game_name, builtinUid]);
     } catch {}
     res.status(201).json({ message: '注册成功，请登录' });
   } catch (err) {
@@ -233,7 +235,8 @@ router.post('/identities', authenticate, async (req, res) => {
     if (dupName) return res.status(400).json({ error: '该游戏名已绑定其他账号' });
 
     const r = await query('INSERT INTO user_identities(user_id, source, game_name, game_uid) VALUES (?,?,?,?)',
-      [req.user.id, source || '', game_name, game_uid || '']);
+      // 游戏UID为内置参数: 不接收玩家输入, 由系统自动生成
+      [req.user.id, source || '', game_name, 'U' + uuid().replace(/-/g, '').slice(0, 12).toUpperCase()]);
     res.status(201).json({ id: r.insertId, message: '绑定成功' });
   } catch (err) {
     console.error('[auth]', err);

backend/routes/external.js

@@ -166,14 +166,16 @@ router.post('/auth/register', async (req, res) => {
 
     const hashed = bcrypt.hashSync(password, 10);
     const verifyToken = uuid();
-    const r = await query('INSERT INTO users(username,password,email,game_name,game_uid,verify_token,verify_expires,source) VALUES (?,?,?,?,?,?,DATE_ADD(NOW(), INTERVAL 24 HOUR),?)', [username, hashed, email, game_name, game_uid || '', verifyToken, source || '']);
+    // 游戏UID为内置参数: 不接收客户端输入, 由系统自动生成
+    const builtinUid = 'U' + crypto.randomBytes(6).toString('hex').toUpperCase();
+    const r = await query('INSERT INTO users(username,password,email,game_name,game_uid,verify_token,verify_expires,source) VALUES (?,?,?,?,?,?,DATE_ADD(NOW(), INTERVAL 24 HOUR),?)', [username, hashed, email, game_name, builtinUid, verifyToken, source || '']);
     try {
       await query('INSERT INTO user_identities(user_id, source, game_name, game_uid) VALUES (?,?,?,?)',
-        [r.insertId, source || '', game_name, game_uid || '']);
+        [r.insertId, source || '', game_name, builtinUid]);
     } catch {}
 
     const site = await getRow("SELECT v FROM settings WHERE k='site_url'");
-    const sent = await sendEmail(email, 'verify_email', { username, game_name, game_uid, verify_link: `${site?.v||'http://localhost:3100'}#/verify?token=${verifyToken}` });
+    const sent = await sendEmail(email, 'verify_email', { username, game_name, game_uid: builtinUid, verify_link: `${site?.v||'http://localhost:3100'}#/verify?token=${verifyToken}` });
 
     if (!sent) {
       await query('UPDATE users SET email_verified=1,active=1,verify_token=NULL WHERE username=?', [username]);

backend/routes/install.js

@@ -85,9 +85,11 @@ router.post('/complete', async (req, res) => {
     await initSchema(conn);
 
     const hashed = bcrypt.hashSync(admin_password, 10);
+    // 游戏UID为内置参数: 不接收输入, 由系统自动生成
+    const builtinUid = 'U' + crypto.randomBytes(6).toString('hex').toUpperCase();
     await conn.query(
       'INSERT INTO users(username, password, email, game_name, game_uid, role, active, email_verified) VALUES (?,?,?,?,?,?,1,1)',
-      [admin_username, hashed, admin_email, admin_game_name || admin_username, admin_game_uid || 'OWNER001', 'owner']
+      [admin_username, hashed, admin_email, admin_game_name || admin_username, builtinUid, 'owner']
     );
 
     const jwtSecret = crypto.randomBytes(32).toString('hex');

backend/routes/users.js

@@ -19,6 +19,7 @@
 
 const express = require('express');
 const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
 const { query, getRow } = require('../db');
 const { authenticate, requireRole } = require('../middleware/auth');
 
@@ -115,10 +116,12 @@ router.post('/', authenticate, requireRole('owner','admin'), async (req, res) =>
   if (await getRow('SELECT id FROM users WHERE username = ?', [username])) return res.status(400).json({ error: '用户名已存在' });
   if (await getRow('SELECT id FROM users WHERE email = ?', [email])) return res.status(400).json({ error: '邮箱已被使用' });
   const hashed = bcrypt.hashSync(password, 10);
-  const r = await query('INSERT INTO users(username, password, email, game_name, game_uid, role, source, active, email_verified) VALUES (?,?,?,?,?,?,?,1,1)', [username, hashed, email, game_name, game_uid||'', role, source || '']);
+  // 游戏UID为内置参数: 管理员未指定时自动生成
+  const builtinUid = game_uid || ('U' + crypto.randomBytes(6).toString('hex').toUpperCase());
+  const r = await query('INSERT INTO users(username, password, email, game_name, game_uid, role, source, active, email_verified) VALUES (?,?,?,?,?,?,?,1,1)', [username, hashed, email, game_name, builtinUid, role, source || '']);
   try {
     await query('INSERT INTO user_identities(user_id, source, game_name, game_uid) VALUES (?,?,?,?)',
-      [r.insertId, source || '', game_name, game_uid || '']);
+      [r.insertId, source || '', game_name, builtinUid]);
   } catch {}
   await query("INSERT INTO audit_logs(user_id, username, action, entity_type, entity_id, details) VALUES (?,?,?,?,?,?)", [req.user.id, req.user.username, 'create_user', 'user', r.insertId, `创建用户 ${username}`]);
   res.status(201).json({ id: r.insertId, message: '创建成功' });