refactor: 彻底移除 apiSecret 认证方式，仅保留 Bearer + PSK

删除:
- HmacUtil: deriveApiKey/deriveApiSecret/verifyMediabotPsk
- HmacAuthInterceptor: apiSecret 验签/自动创建账户/readBody
- AccountService: generateApiCredentials/registerByInterceptor
- AccountDTO: apiKey 字段
- AuthController: register 返回 apiSecret
- AdminController: generateApiKey 端点
- Users.vue: API Key 列/生成密钥弹窗
- api/index.js: genApiKey

认证方式简化为两种:
  Bearer Token → Web 管理后台
  PSK 签名    → 外部集成客户端

web/src/api/index.js

@@ -45,7 +45,7 @@ export default {
   users: {
     list: () => api.get('/admin/accounts'),
     setTrustLevel: (id, level) => api.post(`/admin/accounts/${id}/trust-level`, null, { params: { level } }),
-    genApiKey: (id) => api.post(`/admin/accounts/${id}/api-key`)
+
   },
   health: () => api.get('/health', { baseURL: '' })
 }