fix(admin): remove email reauth from account reset

frontend/src/app/api/admin/customers/reset/route.ts

@@ -6,7 +6,7 @@ import {
   adminErrorResponse,
   invalidQueryResponse,
   requestId,
-  requireHighRiskAdminMutation,
+  requireAdminMutation,
 } from "@/lib/admin/http";
 
 export const runtime = "nodejs";
@@ -28,7 +28,7 @@ type ResetRow = {
 
 export async function POST(request: Request) {
   try {
-    const session = await requireHighRiskAdminMutation(
+    const session = await requireAdminMutation(
       request,
       "admin.users.manage_roles",
     );

frontend/src/components/admin/users-resource.tsx

@@ -133,7 +133,6 @@ export default function UsersPage() {
       okText="确认重置"
       danger
       confirmLoading={resetting}
-      reauthPermission="admin.users.manage_roles"
       onCancel={() => setResetTarget(null)}
       onSubmit={resetAccount}
     />

frontend/tests/admin-account-reset-contract.test.ts

@@ -6,14 +6,17 @@ const root = new URL("../", import.meta.url);
 const route = readFileSync(new URL("src/app/api/admin/customers/reset/route.ts", root), "utf8");
 const users = readFileSync(new URL("src/components/admin/users-resource.tsx", root), "utf8");
 const migration = readFileSync(new URL("supabase/migrations/20260811020000_admin_customer_account_reset.sql", root), "utf8");
+const administratorsRoute = readFileSync(new URL("src/app/api/admin/administrators/route.ts", root), "utf8");
 
-test("admin account reset stays owner-only, explicit, and high risk", () => {
-  assert.match(route, /requireHighRiskAdminMutation\(\s*request,\s*"admin\.users\.manage_roles",?\s*\)/);
+test("admin account reset stays owner-only and explicit without email reauth", () => {
+  assert.match(route, /requireAdminMutation\(\s*request,\s*"admin\.users\.manage_roles",?\s*\)/);
+  assert.doesNotMatch(route, /requireHighRiskAdminMutation/);
   assert.match(route, /confirmation:\s*z\.literal\("RESET"\)/);
   assert.match(route, /admin_reset_customer_account\(\$1, \$2, \$3, \$4\)/);
   assert.match(users, /permissions\.includes\("admin\.users\.manage_roles"\)/);
-  assert.match(users, /reauthPermission="admin\.users\.manage_roles"/);
+  assert.doesNotMatch(users, /reauthPermission=/);
   assert.match(users, /登录身份、管理员角色、积分及账务审计记录会保留/);
+  assert.match(administratorsRoute, /requireHighRiskAdminMutation\(\s*request,\s*"admin\.users\.manage_roles",?\s*\)/);
 });
 
 test("database reset mirrors the existing staging reset boundary and audits it", () => {