fix: lazy DATA_DIR in sync db (multi-instance safe), demo never admin, first real user auto-promoted

sync-server/src/index.mjs

@@ -233,6 +233,7 @@ const server = http.createServer(async (req, res) => {
         if (existing && existing.id !== auth.user_id) await deleteUserCascade(db, existing);
         const { register } = await import('./auth.mjs');
         const uid = register({ username: 'demo', password: 'demo1234', device_name: 'seed-demo', seed: true }).user_id;
+        db.prepare('UPDATE users SET is_admin=0 WHERE username=?').run('demo');
         const seeded = commandsFor(uid).handleCommand('demo_seed', {});
         console.log('[footprints-sync] demo 账号已重建:', JSON.stringify(seeded));
         return send(200, true, { ok: true, seeded });
@@ -568,6 +569,8 @@ try {
   } else {
     console.log('[footprints-sync] demo 账号已存在 (demo / demo1234)');
   }
+  // demo 永远不是管理员（历史库也一并纠正）
+  d.prepare('UPDATE users SET is_admin=0 WHERE username=?').run('demo');
   const seeded = commandsFor(demoId).handleCommand('demo_seed', {});
   console.log('[footprints-sync] demo 演示数据:', JSON.stringify(seeded));
 } catch (e) { console.log('[footprints-sync] demo 种子跳过:', e.message); }