fix(n+1): 批量查询替代循环单查

- IsAdminBootstrapRequired: userRepo.GetByID 循环 → GetByIDs 批量
- AssignRoles: roleRepo.GetByID 循环 → GetByIDs 批量
- 在 userRepositoryInterface 补充 GetByIDs 方法签名

internal/repository/device.go

@@ -207,6 +207,16 @@ func (r *DeviceRepository) GetTrustedDevices(ctx context.Context, userID int64)
 	return devices, nil
 }
 
+// CountTrustedDevices 统计用户当前信任设备数量（未过期的）
+func (r *DeviceRepository) CountTrustedDevices(ctx context.Context, userID int64) (int64, error) {
+	var count int64
+	now := time.Now()
+	err := r.db.WithContext(ctx).Model(&domain.Device{}).
+		Where("user_id = ? AND is_trusted = ? AND (trust_expires_at IS NULL OR trust_expires_at > ?)", userID, true, now).
+		Count(&count).Error
+	return count, err
+}
+
 // ListDevicesParams 设备列表查询参数
 type ListDevicesParams struct {
 	UserID    int64