fix: treat guest as unauthenticated in user state

internal/api/server.go

@@ -563,7 +563,14 @@ func (s *Server) me(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusUnauthorized, "not authenticated")
 		return
 	}
-	writeJSON(w, map[string]any{"username": a.Username, "home": a.Home, "admin": a.Admin, "mask": permString(a.MaskFor(a.Home)), "managed": a.PasswordHash != "", "enabled": a.Enabled})
+	// The anonymous account is an authorization identity, not a logged-in user.
+	// Keep its internal username for permission matching, but expose an empty
+	// username to the UI so an initial visit is correctly shown as "访客".
+	username := a.Username
+	if a == s.Auth.Guest {
+		username = ""
+	}
+	writeJSON(w, map[string]any{"username": username, "home": a.Home, "admin": a.Admin, "mask": permString(a.MaskFor(a.Home)), "managed": a.PasswordHash != "", "enabled": a.Enabled})
 }
 
 type accessibleRoot struct {