Cleanup: remove dead auth middleware and fix security log leak

- Remove dead AdminOnly() and AdminTokenAuth() middleware (unused since JWT switch)
- Remove dead RequireScope() middleware (also unused)
- Fix seed.go: only log password when auto-generated (was logging every time)
- Fix seed.go: use admin.Username (normalized) instead of raw username in log
- Simplify generateRandomPassword: 12 bytes (24 hex chars) instead of 24 bytes then truncate
- Me handler: use claims.Subject (UUID) for lookup instead of username
- Remove unused /logout endpoint (stateless JWT)

internal/db/seed.go

@@ -16,7 +16,7 @@ func generateRandomPassword(length int) (string, error) {
 	if _, err := rand.Read(bytes); err != nil {
 		return "", err
 	}
-	return hex.EncodeToString(bytes)[:length], nil
+	return hex.EncodeToString(bytes), nil
 }
 
 func SeedAdminUser(db *gorm.DB, username, password string) error {
@@ -28,13 +28,14 @@ func SeedAdminUser(db *gorm.DB, username, password string) error {
 	}
 
 	pwd := password
+	autoGenerated := false
 	if pwd == "" {
 		var err error
-		pwd, err = generateRandomPassword(24)
+		pwd, err = generateRandomPassword(12)
 		if err != nil {
 			return err
 		}
-		slog.Warn("no ADMIN_PASSWORD set — generated random password (save this, it won't be shown again)")
+		autoGenerated = true
 	}
 
 	hash, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
@@ -54,6 +55,8 @@ func SeedAdminUser(db *gorm.DB, username, password string) error {
 	}
 
 	slog.Info("admin user seeded", "username", admin.Username)
-	slog.Warn("ADMIN USER: username=" + username + " password=" + pwd + " (save this, it won't be shown again)")
+	if autoGenerated {
+		slog.Warn("ADMIN USER: username=" + admin.Username + " password=" + pwd + " (save this, it won't be shown again)")
+	}
 	return nil
 }