fix(database): create the first panel user with random credentials

The first user is now created when the server starts, with a random
username and password printed once to its log (docker logs, the journal),
instead of a fixed pair seeded by InitDB. CLI calls that initialize the
database are often piped away, as the Docker entrypoint's port lookup is, so
only the server's own log reliably reaches the operator.

`x-ui setting -show` keeps reporting hasDefaultCredential: true until a user
exists, so install.sh still sets its own credentials on a fresh install.
Existing databases are not changed. Verified on a built binary: fresh
setting -show, install.sh-style credential set, first start, login and
restart. The PostgreSQL lane was not run locally; the change adds no query.

internal/web/service/panel/user.go

@@ -36,6 +36,19 @@ func (s *UserService) GetFirstUser() (*model.User, error) {
 	return user, nil
 }
 
+// HasDefaultCredential reports that nobody has chosen the login yet: a database
+// holds no user before the first start, and an older one may still hold admin/admin.
+func (s *UserService) HasDefaultCredential() (bool, error) {
+	user, err := s.GetFirstUser()
+	if database.IsNotFound(err) {
+		return true, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	return user.Username == "admin" && crypto.CheckPasswordHash(user.Password, "admin"), nil
+}
+
 func (s *UserService) CheckUser(username string, password string, twoFactorCode string) (*model.User, error) {
 	db := database.GetDB()
 

internal/web/service/panel/user_test.go

@@ -0,0 +1,50 @@
+package panel
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+	"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
+)
+
+// install.sh replaces the credentials only while this reports true, and before
+// the first start a database holds no user at all.
+func TestHasDefaultCredential(t *testing.T) {
+	hash := func(t *testing.T, password string) string {
+		t.Helper()
+		h, err := crypto.HashPasswordAsBcrypt(password)
+		if err != nil {
+			t.Fatalf("hash: %v", err)
+		}
+		return h
+	}
+	cases := []struct {
+		name string
+		user *model.User
+		want bool
+	}{
+		{name: "no user before the first start", user: nil, want: true},
+		{name: "legacy admin/admin", user: &model.User{Username: "admin", Password: hash(t, "admin")}, want: true},
+		{name: "chosen credentials", user: &model.User{Username: "admin", Password: hash(t, "s3cret-Pass")}, want: false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dbtest.InitDB(t, filepath.Join(t.TempDir(), "x-ui.db"))
+			if err := database.GetDB().Where("1 = 1").Delete(&model.User{}).Error; err != nil {
+				t.Fatalf("clear users: %v", err)
+			}
+			if tc.user != nil {
+				if err := database.GetDB().Create(tc.user).Error; err != nil {
+					t.Fatalf("create user: %v", err)
+				}
+			}
+			got, err := (&UserService{}).HasDefaultCredential()
+			if err != nil || got != tc.want {
+				t.Fatalf("HasDefaultCredential() = %v, %v; want %v", got, err, tc.want)
+			}
+		})
+	}
+}