fix: admin auth UX, password policy, deps, db pool

routes/api_auth.py

@@ -43,6 +43,10 @@ def register():
     if not username or not password:
         return jsonify({"error": "用户名和密码不能为空"}), 400
 
+    is_valid, error_msg = validate_password(password)
+    if not is_valid:
+        return jsonify({"error": error_msg}), 400
+
     client_ip = get_client_ip()
 
     allowed, error_msg = check_ip_rate_limit(client_ip)