Allow changing username and password in settings; admin can delete duplicate accounts.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/routes.py

@@ -95,9 +95,43 @@ def register_routes(app: Flask) -> None:
     def settings_page():
         return render_template("settings.html")
 
+    @app.post("/settings/profile")
+    @login_required
+    def settings_profile():
+        old_pwd = request.form.get("old_password") or ""
+        new_username = (request.form.get("username") or "").strip()
+        new_pwd = request.form.get("new_password") or ""
+        new_pwd2 = request.form.get("new_password2") or ""
+        if new_pwd or new_pwd2:
+            if new_pwd != new_pwd2:
+                flash("两次输入的新密码不一致", "error")
+                return redirect(url_for("settings_page"))
+        else:
+            new_pwd = None
+        try:
+            prev = session.get("username") or ""
+            updated = database.change_user_credentials(
+                int(session["user_id"]),
+                old_pwd,
+                new_username=new_username,
+                new_password=new_pwd,
+            )
+            session["username"] = updated["username"]
+            session["user"] = updated["username"]
+            parts = []
+            if updated["username"] != prev:
+                parts.append("用户名")
+            if new_pwd:
+                parts.append("密码")
+            flash(("、".join(parts) or "资料") + "已更新", "ok")
+        except ValueError as exc:
+            flash(str(exc), "error")
+        return redirect(url_for("settings_page"))
+
     @app.post("/settings/password")
     @login_required
     def settings_password():
+        """兼容旧表单：仅改密码。"""
         old_pwd = request.form.get("old_password") or ""
         new_pwd = request.form.get("new_password") or ""
         new_pwd2 = request.form.get("new_password2") or ""
@@ -216,6 +250,17 @@ def register_routes(app: Flask) -> None:
         flash("标注已保存", "ok")
         return redirect(url_for("accounts_page"))
 
+    @app.post("/accounts/<int:aid>/delete")
+    @admin_required
+    def accounts_delete(aid: int):
+        try:
+            with database.get_db() as conn:
+                database.delete_account(conn, aid)
+            flash("账户已删除", "ok")
+        except ValueError as exc:
+            flash(str(exc), "error")
+        return redirect(url_for("accounts_page"))
+
     @app.get("/machines")
     @login_required
     def machines_page():