feat: P0 commercial readiness — password security, legal, account management

Backend changes for Phase A of v1.0 commercial launch:

P0-3: Password Security
- Remove hardcoded admin/123456 defaults from 34+ bootstrap scripts
- Add PLATFORM_USERNAME/PLATFORM_PASSWORD env vars to config
- Add PUT /api/v1/auth/change-password endpoint (requires old password)

P0-1: User Agreement & Privacy Policy
- Add agreed_terms/agreed_terms_version/agreed_terms_at to User model
- New GET /api/v1/legal/privacy and GET /api/v1/legal/terms endpoints
- New POST /api/v1/legal/agree endpoint to record consent
- Register endpoint now validates agreed_terms must be True

P0-6: Account Management
- Add phone/status/is_email_verified to User model
- Add DELETE /api/v1/auth/account for account deletion (with password confirmation)
- Add PUT /api/v1/auth/phone for phone binding
- Reject authentication for deleted accounts (status=deleted)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/scripts/test_homework_agent_hello.py

@@ -22,8 +22,8 @@ import requests
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="测试学生作业管理助手发送“你好”")
     parser.add_argument("--base-url", default="http://127.0.0.1:8037", help="后端地址")
-    parser.add_argument("--username", default="admin", help="登录用户名")
-    parser.add_argument("--password", default="123456", help="登录密码")
+    parser.add_argument("--username", default=None, help="登录用户名")
+    parser.add_argument("--password", default=None, help="登录密码")
     parser.add_argument("--agent-name", default="学生作业管理助手", help="目标 Agent 名称")
     parser.add_argument("--message", default="你好", help="发送内容")
     parser.add_argument("--timeout-seconds", type=int, default=90, help="轮询超时秒数")