fix: 将密码最小长度调整为 11 位

backend/config.py

@@ -158,8 +158,8 @@ def validate_production_security() -> None:
             or JWT_SECRET.startswith("replace-") or len(JWT_SECRET) < 32):
         errors.append("JWT_SECRET 必须设置为至少 32 位的随机字符串")
     if (ADMIN_PASSWORD == "admin123" or ADMIN_PASSWORD.startswith("change-")
-            or len(ADMIN_PASSWORD) < 12):
-        errors.append("ADMIN_PASSWORD 必须设置为至少 12 位的强密码")
+            or len(ADMIN_PASSWORD) < 11):
+        errors.append("ADMIN_PASSWORD 必须设置为至少 11 位的强密码")
     if not CORS_ALLOWED_ORIGINS or "*" in CORS_ALLOWED_ORIGINS:
         errors.append("CORS_ALLOWED_ORIGINS 必须设置为实际 HTTPS 前端域名，且不能为 *")
     if not os.getenv("TRUSTED_HOSTS") or "*" in TRUSTED_HOSTS:

backend/routers/users.py

@@ -35,8 +35,8 @@ async def create_user(data: dict, user: dict = Depends(get_current_user), db: Se
 
     if not username or not password:
         raise HTTPException(status_code=400, detail="用户名和密码不能为空")
-    if len(password) < 12:
-        raise HTTPException(status_code=400, detail="密码至少 12 位")
+    if len(password) < 11:
+        raise HTTPException(status_code=400, detail="密码至少 11 位")
     if db.query(User).filter(User.username == username).first():
         raise HTTPException(status_code=400, detail="用户名已存在")
 
@@ -61,8 +61,8 @@ async def change_password(user_id: str, data: dict, user: dict = Depends(get_cur
         raise HTTPException(status_code=404, detail="用户不存在")
 
     new_password = data.get("password", "").strip()
-    if not new_password or len(new_password) < 12:
-        raise HTTPException(status_code=400, detail="密码至少 12 位")
+    if not new_password or len(new_password) < 11:
+        raise HTTPException(status_code=400, detail="密码至少 11 位")
 
     target.password_hash = hash_password(new_password)
     db.commit()