fix: harden first-run database setup

backend/src/test/java/com/kaidi/finance/setup/SetupApplicationIntegrationTest.java

@@ -63,6 +63,7 @@ class SetupApplicationIntegrationTest {
         ResponseEntity<JsonNode> initial = rest.getForEntity(url("/api/v1/setup/status"), JsonNode.class);
         assertThat(initial.getStatusCode()).isEqualTo(HttpStatus.OK);
         assertThat(initial.getBody().path("data").path("required").asBoolean()).isTrue();
+        assertThat(initial.getBody().path("data").path("ready").asBoolean()).isFalse();
 
         Map<String, Object> database = databaseRequest("wrong-code");
         ResponseEntity<JsonNode> denied = rest.postForEntity(url("/api/v1/setup/test-connection"),
@@ -76,6 +77,22 @@ class SetupApplicationIntegrationTest {
         assertThat(tested.getStatusCode()).isEqualTo(HttpStatus.OK);
         assertThat(tested.getBody().path("data").path("successful").asBoolean()).isTrue();
         assertThat(tested.getBody().path("data").path("schemaReady").asBoolean()).isTrue();
+        assertThat(tested.getBody().path("data").path("message").asText()).contains("完整迁移权限验证通过");
+
+        try (Connection connection = DriverManager.getConnection(MYSQL.getJdbcUrl(), MYSQL.getUsername(),
+            MYSQL.getPassword()); Statement statement = connection.createStatement()) {
+            try (ResultSet result = statement.executeQuery("""
+                SELECT
+                  (SELECT COUNT(*) FROM information_schema.tables
+                   WHERE table_schema = DATABASE() AND table_name LIKE 'kaidi_setup_probe_%')
+                  +
+                  (SELECT COUNT(*) FROM information_schema.routines
+                   WHERE routine_schema = DATABASE() AND routine_name LIKE 'kaidi_setup_probe_%')
+                """)) {
+                result.next();
+                assertThat(result.getInt(1)).isZero();
+            }
+        }
 
         Map<String, Object> complete = new LinkedHashMap<>(database);
         complete.put("adminUsername", "setup-admin");
@@ -121,6 +138,7 @@ class SetupApplicationIntegrationTest {
         ResponseEntity<JsonNode> locked = rest.getForEntity(url("/api/v1/setup/status"), JsonNode.class);
         assertThat(locked.getBody().path("data").path("required").asBoolean()).isFalse();
         assertThat(locked.getBody().path("data").path("locked").asBoolean()).isTrue();
+        assertThat(locked.getBody().path("data").path("ready").asBoolean()).isFalse();
     }
 
     private Map<String, Object> databaseRequest(String setupCode) {

backend/src/test/java/com/kaidi/finance/setup/SetupReadinessTest.java

@@ -0,0 +1,31 @@
+package com.kaidi.finance.setup;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class SetupReadinessTest {
+
+    private static final String TOKEN_SHA256 =
+        "9158568c96987884c8141d363daceffda86bb17083054b36105934090aa7e166";
+
+    @TempDir
+    private Path stateRoot;
+
+    @Test
+    void distinguishesLockedSetupModeFromReadyApplicationMode() {
+        SetupProperties properties = new SetupProperties(true, TOKEN_SHA256,
+            stateRoot.resolve("application.env").toString(), stateRoot.resolve("locked").toString(), false);
+
+        SetupViews.Status setupMode = new SetupService(properties).status();
+        SetupViews.Status applicationMode = new SetupLockedController().status().data();
+
+        assertThat(setupMode.required()).isTrue();
+        assertThat(setupMode.ready()).isFalse();
+        assertThat(applicationMode.required()).isFalse();
+        assertThat(applicationMode.locked()).isTrue();
+        assertThat(applicationMode.ready()).isTrue();
+    }
+}