feat: add single-admin application onboarding and token rotation

internal/storage/mysql/credentials.go

@@ -209,6 +209,11 @@ func ValidateCredentialOperation(op CredentialOperation) error {
 // receipt. No callback or file I/O occurs inside the transaction. A commit error
 // is intentionally returned unchanged; replaying the same operation reconciles it.
 func ApplyCredentialOperation(ctx context.Context, db *sql.DB, op CredentialOperation) (CredentialChangeReceipt, error) {
+	return applyCredentialOperation(ctx, db, op, nil)
+}
+
+// applyCredentialOperation 允许控制台在同一事务先核验管理员，并使用真实人类审计主体。
+func applyCredentialOperation(ctx context.Context, db *sql.DB, op CredentialOperation, authorize func(*sql.Tx) (string, error)) (CredentialChangeReceipt, error) {
 	var out CredentialChangeReceipt
 	if err := ValidateCredentialOperation(op); err != nil {
 		return out, err
@@ -217,6 +222,14 @@ func ApplyCredentialOperation(ctx context.Context, db *sql.DB, op CredentialOper
 		return out, err
 	}
 	err := WithTx(ctx, db, func(tx *sql.Tx) error {
+		actor := ""
+		if authorize != nil {
+			var err error
+			actor, err = authorize(tx)
+			if err != nil {
+				return err
+			}
+		}
 		var name string
 		var revision uint64
 		var expires, revoked sql.NullTime
@@ -286,9 +299,11 @@ func ApplyCredentialOperation(ctx context.Context, db *sql.DB, op CredentialOper
 		out.Action = op.Action
 		out.Revision = revision + 1
 		out.AppliedAt = now
-		actor, err := databaseActor(ctx, tx)
-		if err != nil {
-			return err
+		if actor == "" {
+			actor, err = databaseActor(ctx, tx)
+			if err != nil {
+				return err
+			}
 		}
 		if err := appendCredentialAudit(ctx, tx, actor, op, before, after); err != nil {
 			return err