refactor: 彻底移除 apiSecret 认证方式，仅保留 Bearer + PSK

删除:
- HmacUtil: deriveApiKey/deriveApiSecret/verifyMediabotPsk
- HmacAuthInterceptor: apiSecret 验签/自动创建账户/readBody
- AccountService: generateApiCredentials/registerByInterceptor
- AccountDTO: apiKey 字段
- AuthController: register 返回 apiSecret
- AdminController: generateApiKey 端点
- Users.vue: API Key 列/生成密钥弹窗
- api/index.js: genApiKey

认证方式简化为两种:
  Bearer Token → Web 管理后台
  PSK 签名    → 外部集成客户端

par-api/src/main/java/com/par/api/controller/AdminController.java

@@ -159,29 +159,6 @@ public class AdminController {
         return ApiResponse.success();
     }
 
-    /**
-     * 生成/重置 API Key
-     */
-    @PostMapping("/accounts/{accountId}/api-key")
-    public ApiResponse<Map<String, String>> generateApiKey(
-            @PathVariable Long accountId,
-            HttpServletRequest request) {
-        checkAdmin(request);
-
-        var account = accountMapper.selectById(accountId);
-        if (account == null) {
-            return ApiResponse.error(404, "Account not found");
-        }
-
-        String[] keys = accountService.generateApiCredentials(accountId);
-        Map<String, String> result = new java.util.LinkedHashMap<>();
-        result.put("apiKey", keys[0]);
-        result.put("apiSecret", keys[1]);
-        // secret 只在生成时返回一次，前端需要立即保存
-        log.info("API key generated for account: id={}", accountId);
-        return ApiResponse.success(result);
-    }
-
     /**
      * 绑定额外邮箱
      */

par-api/src/main/java/com/par/api/controller/AuthController.java

@@ -36,8 +36,8 @@ public class AuthController {
     }
 
     /**
-     * 用户注册（自动生成 API Key）
-     * 携带 PSK 签名头 → 自动提权为 TRUSTED
+     * 用户注册（密码可选）
+     * 携带 PSK 头自动提权为 TRUSTED
      */
     @PostMapping("/register")
     public ApiResponse<Map<String, Object>> register(
@@ -45,24 +45,18 @@ public class AuthController {
             HttpServletRequest httpRequest) {
         Account account = accountService.register(request);
 
-        // PSK 签名验证通过 → 自动提权
         if (verifyMediabotPsk(httpRequest, request.getEmail())) {
             account.setTrustLevel(com.par.core.enums.TrustLevel.TRUSTED);
             accountService.updateAccount(account);
-            log.info("Account auto-trusted via PSK: email={}", account.getEmail());
         }
 
-        AccountDTO dto = accountService.toDTO(account);
         Map<String, Object> result = new LinkedHashMap<>();
-        result.put("account", dto);
-        result.put("apiKey", account.getApiKey());
-        result.put("apiSecret", account.getApiSecret());
+        result.put("account", accountService.toDTO(account));
         return ApiResponse.success(result);
     }
 
     /**
-     * 账户恢复（DB 重置后无需管理员介入）
-     * PSK 签名验证通过 → 返回/重建凭据
+     * PSK 签名恢复账户
      */
     @PostMapping("/recover")
     public ApiResponse<Map<String, Object>> recover(
@@ -79,44 +73,34 @@ public class AuthController {
             return ApiResponse.error(403, "Invalid PSK signature");
         }
 
-        // 查找或创建账户
         Account account = accountService.findByAnyEmail(email);
         if (account == null) {
-            // 自动创建 + 提权
             RegisterRequest req = new RegisterRequest();
             req.setEmail(email);
             account = accountService.register(req);
         }
-        // 确保是 TRUSTED
         if (account.getTrustLevel().ordinal() < com.par.core.enums.TrustLevel.TRUSTED.ordinal()) {
             account.setTrustLevel(com.par.core.enums.TrustLevel.TRUSTED);
             accountService.updateAccount(account);
         }
 
-        AccountDTO dto = accountService.toDTO(account);
         Map<String, Object> result = new LinkedHashMap<>();
-        result.put("account", dto);
-        result.put("apiKey", account.getApiKey());
-        result.put("apiSecret", account.getApiSecret());
+        result.put("account", accountService.toDTO(account));
         log.info("Account recovered via PSK: email={}", email);
         return ApiResponse.success(result);
     }
 
     /**
-     * 用户登录，返回 Bearer token + api_key
+     * 用户登录，返回 Bearer token
      */
     @PostMapping("/login")
     public ApiResponse<AccountDTO> login(@Valid @RequestBody LoginRequest request) {
         Account account = accountService.login(request);
         AccountDTO dto = accountService.toDTO(account);
         dto.setToken(hmacAuthInterceptor.generateToken(account.getEmail()));
-        dto.setApiKey(account.getApiKey());
         return ApiResponse.success(dto);
     }
 
-    /**
-     * 验证 X-Medibot-Timestamp + X-Medibot-Signature（通过 PskService）
-     */
     private boolean verifyMediabotPsk(HttpServletRequest request, String email) {
         String ts = request.getHeader("X-Medibot-Timestamp");
         String sig = request.getHeader("X-Medibot-Signature");