Cleanup: remove dead auth middleware and fix security log leak

- Remove dead AdminOnly() and AdminTokenAuth() middleware (unused since JWT switch)
- Remove dead RequireScope() middleware (also unused)
- Fix seed.go: only log password when auto-generated (was logging every time)
- Fix seed.go: use admin.Username (normalized) instead of raw username in log
- Simplify generateRandomPassword: 12 bytes (24 hex chars) instead of 24 bytes then truncate
- Me handler: use claims.Subject (UUID) for lookup instead of username
- Remove unused /logout endpoint (stateless JWT)

internal/api/handlers/admin/me.go

@@ -29,7 +29,12 @@ func (h *MeHandler) Me(c *gin.Context) {
 	}
 
 	var user db.AdminUser
-	if err := h.db.Where("username = ?", claims.Username).First(&user).Error; err != nil {
+	userID, err := uuid.Parse(claims.Subject)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "Invalid token claims"}})
+		return
+	}
+	if err := h.db.Where("id = ?", userID).First(&user).Error; err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": gin.H{"code": "unauthorized", "message": "User not found"}})
 		return
 	}