fix: detect ghost LoginProfile from Volcengine (CreateDate=1970)

Users created without console password have a phantom LoginProfile
that GetLoginProfile returns but UpdateLoginProfile/DeleteLoginProfile
reject. Now checking CreateDate to detect this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/utils/iam_service.py

@@ -198,9 +198,14 @@ class IAMService:
             pass
 
     def _has_login_profile(self, username: str) -> bool:
-        """检查用户是否有 LoginProfile"""
+        """检查用户是否有真实的 LoginProfile（火山可能返回空壳）"""
         try:
-            self.get_login_profile(username)
+            resp = self.get_login_profile(username)
+            profile = resp.get("Result", {}).get("LoginProfile", {})
+            # Empty shell has CreateDate=19700101 and Password=""
+            create_date = profile.get("CreateDate", "")
+            if create_date.startswith("1970") or create_date.startswith("0001"):
+                return False
             return True
         except VolcengineAPIError as e:
             if "LoginProfileNotExist" in str(e) or "RecordNotFound" in str(e):