refactor(idgen): centralize negative ID handling via panic

Restore NextUint64ID() to uint64-only API so callers need no error
checks. Retry logic stays in idgen; after 3 negative values it panics
instead of returning 0, preventing silent NULL primary keys.

internal/model/errs.go

@@ -5,7 +5,6 @@ package model
 
 const (
 	errRegistrationDisabled                 = "注册已关闭"
-	errInvalidUserID                        = "用户 ID 生成失败"
 	errDatabaseNotInitialized               = "database not initialized"
 	errUsernameExists                       = "用户名已存在"
 	errEmailAlreadyBound                    = "该邮箱已被其他账号绑定"