v2.4.1: 修复 2FA 登录和前端数据加载问题

- 修复登录接口 response_model 导致 2FA 返回格式验证失败(500错误)
- 修复 showProfile 未调用 loadTwofaStatus 导致 2FA 状态一直显示加载中
- 修复 hideOthers 默认值为 false 确保管理员可查看所有数据
- 删除重复的 doLogin 函数
- 删除残留的代码片段修复 JavaScript 语法错误

backend/app/main.py

@@ -6,7 +6,7 @@ from app.core.config import get_settings
 from app.core.database import engine, async_session
 from app.models.models import Base, User, Debt, RepaymentPlan, RepaymentRecord, Group
 from app.core.security import hash_password
-from app.api import auth, debts, repayments, admin, loans, notifications
+from app.api import auth, debts, repayments, admin, loans, notifications, twofa
 from sqlalchemy import select, text
 
 settings = get_settings()
@@ -52,10 +52,23 @@ async def migrate_account_names():
 
 
 async def migrate_add_real_email():
+    async with engine.begin() as conn:
+        try:
+            await conn.execute(text(
+                "ALTER TABLE users ADD COLUMN IF NOT EXISTS real_email VARCHAR(255) DEFAULT ''"
+            ))
+        except Exception:
+            pass  # 表不存在时跳过，由 seed_admin 创建
+
+async def migrate_add_2fa():
     async with engine.begin() as conn:
         await conn.execute(text(
-            "ALTER TABLE users ADD COLUMN IF NOT EXISTS real_email VARCHAR(255) DEFAULT ''"
+            "ALTER TABLE users ADD COLUMN IF NOT EXISTS two_factor_secret VARCHAR(32)"
         ))
+        await conn.execute(text(
+            "ALTER TABLE users ADD COLUMN IF NOT EXISTS two_factor_enabled INTEGER DEFAULT 0"
+        ))
+
 
 
 async def migrate_debt_data():
@@ -98,6 +111,7 @@ async def migrate_debt_data():
 async def lifespan(app: FastAPI):
     await seed_admin()
     await migrate_add_real_email()
+    await migrate_add_2fa()
     await migrate_account_names()
     await migrate_debt_data()
     from app.services.scheduler import start_scheduler, check_upcoming_repayments
@@ -139,6 +153,7 @@ app.include_router(debts.router, prefix=settings.API_V1_PREFIX)
 app.include_router(repayments.router, prefix=settings.API_V1_PREFIX)
 app.include_router(admin.router, prefix=settings.API_V1_PREFIX)
 app.include_router(notifications.router, prefix=settings.API_V1_PREFIX)
+app.include_router(twofa.router, prefix=settings.API_V1_PREFIX)
 
 
 @app.get("/health")