fix: server 审查修复——member_id 校验、访问日志 finally、静默初始化并发

非法 member_id 不再以 NaN 入库；HTTP 访问日志覆盖异常路径；setup-state 静默建管理员遇唯一冲突视为已初始化。

apps/server/src/routes/admin-session.ts

@@ -74,14 +74,18 @@ export function adminSessionRoutes() {
       const initUser = c.get("adminInitUsername");
       const initPass = c.get("adminInitPassword");
       if (initUser && initPass) {
-        const password_hash = await hashPassword(initPass);
-        await repos.users.insert(initUser, password_hash);
-        await repos.audit.insert({
-          operator: null,
-          domain: "account",
-          action: "account.init",
-          summary: "空库 env 静默重建管理员",
-        });
+        try {
+          const password_hash = await hashPassword(initPass);
+          await repos.users.insert(initUser, password_hash);
+          await repos.audit.insert({
+            operator: null,
+            domain: "account",
+            action: "account.init",
+            summary: "空库 env 静默重建管理员",
+          });
+        } catch {
+          // 并发/重复初始化：唯一约束冲突时视为已初始化
+        }
         return c.json({ initialized: true }, 200);
       }
       return c.json({ initialized: false }, 200);