feat(auth): block panel with default admin/admin credentials and guide credential change

checkLogin middleware now detects default admin/admin credentials and
redirects every panel route to /panel/settings until they are changed.
The settings page auto-opens the Authentication tab, shows a
non-dismissible error banner, and lists 'Default credentials' first in
the security checklist. Login response includes mustChangeCredentials
so the login page can redirect directly. Logout is now POST-only.
Password must be at least 10 characters and cannot be admin/admin.

web/service/user.go

@@ -102,6 +102,21 @@ func (s *UserService) CheckUser(username string, password string, twoFactorCode
 	return user, nil
 }
 
+func (s *UserService) VerifyTwoFactorCode(code string) (bool, error) {
+	twoFactorEnable, err := s.settingService.GetTwoFactorEnable()
+	if err != nil {
+		return false, err
+	}
+	if !twoFactorEnable {
+		return true, nil
+	}
+	twoFactorToken, err := s.settingService.GetTwoFactorToken()
+	if err != nil {
+		return false, err
+	}
+	return gotp.NewDefaultTOTP(twoFactorToken).Now() == code, nil
+}
+
 func (s *UserService) UpdateUser(id int, username string, password string) error {
 	db := database.GetDB()
 	hashedPassword, err := crypto.HashPasswordAsBcrypt(password)