修复初始化向导MySQL密码转换

允许旧版 MySQL DSN 正确迁移包含 @ 的密码，并增加加密存储回归用例。

backend/config/migrate.go

@@ -112,7 +112,7 @@ var legacyPluginExecutableMap = map[string]string{
 	"pmail_telegram_push.exe": "telegram_push",
 }
 
-var legacyMySQLDSNPattern = regexp.MustCompile(`^([^:@/[:space:]]+):([^@\r\n]*)@tcp\(([^():/[:space:]]+)(?::([0-9]{1,5}))?\)/([A-Za-z0-9][A-Za-z0-9._-]{0,127})(?:\?[^#[:space:]]*)?$`)
+var legacyMySQLDSNPattern = regexp.MustCompile(`^([^:@/[:space:]]+):([^\r\n]*)@tcp\(([^():/[:space:]]+)(?::([0-9]{1,5}))?\)/([A-Za-z0-9][A-Za-z0-9._-]{0,127})(?:\?[^#[:space:]]*)?$`)
 
 func PlanLegacyMigration(root string, _ RuntimeValidationOptions) (LegacyMigrationPlan, error) {
 	directory, err := secureManagerConfigDirectory(root)

backend/config/migrate_test.go

@@ -631,6 +631,15 @@ func TestMigrateLegacyConfigParsesKnownStructuredDatabaseDSNs(t *testing.T) {
 			wantHost: "db.example.com",
 			wantName: "smail",
 			password: "database-secret",
+		}, {
+			name:     "MySQL password with at sign",
+			database: DBTypeMySQL,
+			dsn:      "smail:database@secret@tcp(db.example.com:3307)/smail?charset=utf8mb4",
+			wantType: DatabaseTypeMySQL,
+			wantPort: 3307,
+			wantHost: "db.example.com",
+			wantName: "smail",
+			password: "database@secret",
 		},
 		{
 			name:     "PostgreSQL",