Remove login defaults; open review via device token SSO.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/db.py

@@ -247,6 +247,24 @@ def auth_token(conn: sqlite3.Connection, token: str) -> Optional[dict]:
     return row_to_dict(row)
 
 
+def resolve_web_user_for_activation(conn: sqlite3.Connection, act: dict) -> Optional[dict]:
+    """设备 token → 网页登录用户：优先账户绑定用户，其次发放激活码的用户。"""
+    account_id = act.get("account_id")
+    if account_id:
+        u = conn.execute(
+            "SELECT * FROM users WHERE account_id=? AND enabled=1",
+            (account_id,),
+        ).fetchone()
+        if u:
+            return row_to_dict(u)
+    created_by = act.get("created_by")
+    if created_by:
+        u = get_user(conn, int(created_by))
+        if u and int(u.get("enabled") or 0) == 1:
+            return u
+    return None
+
+
 def _trades_where(
     account_id: Optional[int] = None,
     machine_id: Optional[int] = None,