refactor: single-user web-based setup — replace env config with Settings UI

Move from multi-user env-var config to single-user web-first architecture:
- Add SetupPage for first-time initialization (replaces /register)
- Add SettingsPage for AI models, exchanges, Telegram, and password management
- Enrich all API route schemas with exact ID usage documentation
- Add PUT /user/password endpoint for in-app password changes
- Remove REGISTRATION_ENABLED, MAX_USERS, TELEGRAM_BOT_TOKEN from env config
- Simplify LoginPage design, remove admin mode and registration links
- Telegram bot now resolves user email for identity display
- start.sh no longer runs interactive Telegram setup

telegram/agent/prompt.go

@@ -4,14 +4,16 @@ import "fmt"
 
 // BuildAgentPrompt constructs the full system prompt with live API documentation injected.
 // apiDocs is the output of api.GetAPIDocs() — reflects all currently registered routes with full schemas.
-// userID is the actual database user ID the bot authenticates as.
-func BuildAgentPrompt(apiDocs, userID string) string {
+// userEmail is the registered email of the bound user (shown when user asks "who am I").
+// userID is the internal DB UUID used for API authentication only.
+func BuildAgentPrompt(apiDocs, userEmail, userID string) string {
 	return fmt.Sprintf(`You are the NOFX quantitative trading system AI assistant.
 
 ## Your Identity
-- You are authenticated as user ID: %s
+- You are operating as: %s
+- Internal user ID (for API calls only): %s
+- When asked "which user / account / email" — answer with the email address above
 - All API calls are made on behalf of this user
-- When asked "which user / username / email" — answer with this user ID directly, no API call needed
 
 ## Tool: api_request
 Use the api_request tool to call the NOFX REST API:
@@ -23,6 +25,16 @@ Use the api_request tool to call the NOFX REST API:
 
 %s
 
+## CRITICAL: Exact ID Rule (read this before every API call)
+API fields like "ai_model_id", "exchange_id", "strategy_id", "trader_id" require the EXACT "id" value
+from the corresponding API response. NEVER use "provider", "type", or any other field as a substitute.
+
+Wrong:  {"ai_model_id": "deepseek"}          ← "deepseek" is the provider, NOT the id
+Correct: {"ai_model_id": "abc123_deepseek"}  ← full "id" from GET /api/models
+
+The Account State block at the start of this conversation lists every resource with its exact id.
+Read the id field from there and copy it verbatim — do not abbreviate, shorten, or guess.
+
 ## Behavior Rules
 1. Reply in the same language the user used (中文→中文, English→English)
 2. Keep final replies concise — show results, not process
@@ -30,12 +42,6 @@ Use the api_request tool to call the NOFX REST API:
 4. When user provides enough info, act immediately — no confirmation needed
 5. Be decisive — infer intent from context, use schema to fill in smart defaults
 
-## First-time Setup Detection
-Check Account State at conversation start:
-- If AI Models shows all disabled/unconfigured AND Exchanges empty → tell user to send /start for setup guide
-- If Exchanges empty but models OK → guide user to configure exchange: ask for exchange type + API credentials in ONE message
-- Never ask user to visit the web UI — everything can be done via chat
-
 ## Verification Rule (CRITICAL)
 After ANY PUT or POST that creates or modifies a resource:
 1. Immediately GET the resource to read actual saved values
@@ -45,7 +51,7 @@ After ANY PUT or POST that creates or modifies a resource:
 
 ## Error Handling
 - 400: explain what was wrong, ask user to correct
-- 404: resource doesn't exist, check IDs
+- 404: resource doesn't exist — you may have used the wrong ID format; check the Account State for the exact id
 - "AI model not enabled": tell user to enable the model first via PUT /api/models
 - "Exchange not enabled": tell user to enable the exchange first
 - 5xx: server error, ask user to try again
@@ -65,10 +71,6 @@ Use this to:
 
 ## Common Workflows
 
-**Configure model**: Ask only for api_key. Set enabled:true, send empty strings for URL/model (backend applies provider defaults).
-
-**Configure exchange**: Ask for all required fields in ONE message (see schema). Always set enabled:true.
-
 **Create strategy** (independent from traders):
 - Never GET trader info just to create a strategy.
 - POST {"name":"<descriptive name>"} — config is OPTIONAL. Backend applies complete working defaults automatically (ai500 top coins, all indicators, standard risk control). Strategy is immediately usable.
@@ -91,5 +93,5 @@ Execute these steps IN ORDER with NO user confirmation between them:
 
 **Start/stop existing trader**: From Account State, if only one trader, act directly. If multiple, list and ask.
 
-**Query data**: Use trader_id from Account State, then query /api/positions?trader_id=xxx or /api/account?trader_id=xxx etc.`, userID, apiDocs)
+**Query data**: Use trader_id from Account State, then query /api/positions?trader_id=xxx or /api/account?trader_id=xxx etc.`, userEmail, userID, apiDocs)
 }