Cleanup: remove dead auth middleware and fix security log leak

- Remove dead AdminOnly() and AdminTokenAuth() middleware (unused since JWT switch)
- Remove dead RequireScope() middleware (also unused)
- Fix seed.go: only log password when auto-generated (was logging every time)
- Fix seed.go: use admin.Username (normalized) instead of raw username in log
- Simplify generateRandomPassword: 12 bytes (24 hex chars) instead of 24 bytes then truncate
- Me handler: use claims.Subject (UUID) for lookup instead of username
- Remove unused /logout endpoint (stateless JWT)

internal/api/middleware/auth.go

@@ -65,84 +65,6 @@ func APIKeyAuth(authService *auth.Service) gin.HandlerFunc {
 	}
 }
 
-func RequireScope(authService *auth.Service, scope string) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		apiKey, exists := c.Get(ApiKeyCtx)
-		if !exists {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": gin.H{
-					"code":    "invalid_api_key",
-					"message": "Authentication required",
-				},
-			})
-			return
-		}
-
-		key := apiKey.(*db.ApiKey)
-		if !authService.HasScope(key, scope) {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
-				"error": gin.H{
-					"code":    "insufficient_scope",
-					"message": "API key lacks required scope: " + scope,
-				},
-			})
-			return
-		}
-
-		c.Next()
-	}
-}
-
-func AdminOnly() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		apiKey, exists := c.Get(ApiKeyCtx)
-		if !exists {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": gin.H{
-					"code":    "unauthorized",
-					"message": "Admin access required",
-				},
-			})
-			return
-		}
-
-		key := apiKey.(*db.ApiKey)
-		if !key.IsAdmin {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
-				"error": gin.H{
-					"code":    "unauthorized",
-					"message": "Admin access required",
-				},
-			})
-			return
-		}
-
-		c.Next()
-	}
-}
-
-func AdminTokenAuth(token string) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		adminToken := c.GetHeader("X-Admin-Token")
-		if adminToken == "" {
-			adminToken = c.GetHeader("Authorization")
-			adminToken = strings.TrimPrefix(adminToken, "Bearer ")
-		}
-
-		if adminToken != token {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": gin.H{
-					"code":    "unauthorized",
-					"message": "Invalid admin token",
-				},
-			})
-			return
-		}
-
-		c.Next()
-	}
-}
-
 func AdminSessionAuth(jwtService *auth.AdminJWTService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")