feat(force-onboarding): 运营一键开启新手引导 — User.force_onboarding + admin 接口 + /me 带出 + 走完自动清 (#43)

- User 新增 force_onboarding 列(仿 debug_trace_enabled)+ 迁移 user_force_onboarding。
- POST /admin/api/users/{id}/force-onboarding(operator 角色 + 审计 user.force_onboarding.set)。
- UserOut(/me 与登录响应)带出该字段;/api/v1/user/onboarding/complete 走完即自动清回 false,只触发一次。
- 测试:admin 设置+审计+角色守卫、走完引导自动清标记。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: zzhyyyyy <2685922758@qq.com>
Reviewed-on: #43
Co-authored-by: zhuzihao <zhuzihao@wonderable.ai>
Co-committed-by: zhuzihao <zhuzihao@wonderable.ai>

tests/test_admin_write.py

@@ -160,6 +160,48 @@ def test_set_user_status_and_audit(admin_client: TestClient, operator_token: str
     ).status_code == 200
 
 
+# ===== 一键开启新手引导 =====
+
+def test_set_force_onboarding_and_audit(admin_client: TestClient, operator_token: str) -> None:
+    uid = _seed_user("13900000009")
+    r = admin_client.post(
+        f"/admin/api/users/{uid}/force-onboarding", json={"enabled": True},
+        headers=_auth(operator_token),
+    )
+    assert r.status_code == 200, r.text
+    db = SessionLocal()
+    try:
+        assert db.get(User, uid).force_onboarding is True
+        logs = db.execute(
+            select(AdminAuditLog).where(
+                AdminAuditLog.action == "user.force_onboarding.set",
+                AdminAuditLog.target_id == str(uid),
+            )
+        ).scalars().all()
+        assert logs[0].detail == {"before": False, "after": True}
+    finally:
+        db.close()
+    # 取消(回到 false)
+    assert admin_client.post(
+        f"/admin/api/users/{uid}/force-onboarding", json={"enabled": False},
+        headers=_auth(operator_token),
+    ).status_code == 200
+    db = SessionLocal()
+    try:
+        assert db.get(User, uid).force_onboarding is False
+    finally:
+        db.close()
+
+
+def test_finance_cannot_force_onboarding(admin_client: TestClient, finance_token: str) -> None:
+    uid = _seed_user("13900000010")
+    r = admin_client.post(
+        f"/admin/api/users/{uid}/force-onboarding", json={"enabled": True},
+        headers=_auth(finance_token),
+    )
+    assert r.status_code == 403
+
+
 # ===== 角色守卫 =====
 
 def test_operator_cannot_grant_coins(admin_client: TestClient, operator_token: str) -> None: