fix

README.md

@@ -610,8 +610,8 @@ export ALG_SM4_ECB=1025
 
 ## Current Status
 
-- Structure refactored to lightweight monolith modules.
-- Internal and external API entry points separated.
-- Basic auth interceptors for internal/openapi are in place.
-- `init/auth/device/sign/system` modules have runnable skeleton controllers and services.
-- `init/auth/device` modules include mapper+xml+repository-impl+DDL skeleton for TiDB.
+- Spring Boot monolith with modular backend packages for `auth`, `init`, `device`, `mk`, `cert`, `file`, `upgrade`, `backup`, `log`, `openapi`, `sign`, and `system`.
+- Internal `/api/**` and external `/openapi/**` boundaries are separated, with session auth, role/auth-level checks, replay protection, and operation audit coverage on high-risk flows.
+- Initialization/reset, UKey authentication, master-key lifecycle, certificate/CRL management, offline upgrade, resource backup/restore, device/network/time configuration, file upload, and audit-log features all have active code and focused tests.
+- Runtime-generated Swagger/OpenAPI docs remain the source of truth for endpoint shapes; module docs under `docs/openapi/`, `docs/deployment/`, and `docs/analysis/` provide frontend, deployment, and inspection-facing guidance.
+- Historical implementation plans are indexed at [docs/plans/INDEX.md](/Users/waner/Work/CISD/文档/tms-framework/docs/plans/INDEX.md). Prefer the index and current code over old plan files when they disagree.

src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java

@@ -58,6 +58,7 @@ public class AuthAdminController {
     @PostMapping("/roles/{roleCode}/accounts/{uid}/change-password")
     @Operation(summary = "管理员修改角色席位口令", description = "管理员为目标角色指定席位账号设置新口令。")
     @ReplayProtected
+    @Deprecated
     @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
     @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.UPDATE, summary = "管理员修改角色席位口令")
     public ApiResponse<Void> changeAccountPassword(