fix(1panel): grant nexus@% for Docker MySQL 1045 on install

Add fix-1panel-mysql-grant.sh and clearer install wizard errors when
1Panel MySQL only allows nexus@localhost.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/api/install.py

@@ -196,6 +196,22 @@ def _service_tcp_reachable(host: str, port: int, timeout: float = 3.0) -> bool:
         return False
 
 
+def _mysql_auth_error_detail(db_user: str) -> str:
+    """1045 Access denied — common on 1Panel when user is only nexus@localhost."""
+    if os.environ.get("NEXUS_DOCKER_WRITE_ENV") != "1":
+        return (
+            f"MySQL 拒绝用户 {db_user!r} 的密码或主机权限。"
+            "请核对库名/用户名/密码，并确认该用户允许从应用主机连接（非仅 localhost）。"
+        )
+    return (
+        f"MySQL 拒绝用户 {db_user!r}（错误 1045）。Nexus 在 Docker 内通过 1panel-network 连接，"
+        "来源 IP 为容器网段（如 172.18.x.x），不是 localhost。\n"
+        "请在 1Panel MySQL 中确保：① 库 nexus、用户 nexus 已创建 ② 密码与向导一致 "
+        "③ 存在 nexus@'%' 或允许 Docker 网段（仅 nexus@localhost 会失败）。\n"
+        "服务器执行: cd /opt/nexus && bash deploy/fix-1panel-mysql-grant.sh"
+    )
+
+
 def _mysql_connect_error_detail(host: str, port: int) -> str:
     if os.environ.get("NEXUS_DOCKER_WRITE_ENV") != "1":
         return ""
@@ -265,6 +281,11 @@ async def _test_mysql_url(db_url: str) -> tuple[bool, str]:
         await engine.dispose()
         return True, "✓ MySQL 连接正常"
     except Exception as e:
+        err = str(e)
+        if "1045" in err or "Access denied" in err:
+            return False, _mysql_auth_error_detail(
+                urlparse(db_url).username or "nexus"
+            )
         return False, f"✗ MySQL 连接失败: {e}"
 
 
@@ -805,6 +826,8 @@ async def init_db(req: InitDbRequest):
     except Exception as e:
         await engine.dispose()
         err = str(e)
+        if "1045" in err or "Access denied" in err:
+            raise HTTPException(400, _mysql_auth_error_detail(req.db_user)) from e
         if "2003" in err or "Can't connect to MySQL" in err:
             extra = _mysql_connect_error_detail(req.db_host, db_port)
             if extra: