refactor: 修复DRY分页 + LoD违规(RefreshToken业务逻辑下沉)

- audit_service.List()使用common.Pagination替代手动分页计算
- RefreshToken封禁状态检查从控制器移至TokenService.RefreshAccessToken
- 消除控制器层业务逻辑，符合瘦控制器铁律

internal/controller/auth_controller.go

@@ -218,25 +218,20 @@ func (ac *AuthController) RefreshToken(c *gin.Context) {
 		return
 	}
 
-	accessToken, user, err := ac.tokenService.RefreshAccessToken(refreshToken)
+	accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
 	if err != nil {
 		common.ClearAuthCookies(c, ac.cfg)
 		switch err {
 		case common.ErrTokenExpired, common.ErrTokenRevoked:
 			common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
+		case common.ErrUserBanned:
+			common.Error(c, http.StatusForbidden, "账号已被封禁")
 		default:
 			common.Error(c, http.StatusUnauthorized, "请重新登录")
 		}
 		return
 	}
 
-	// 防止封禁用户通过 refresh 续期（状态检查是认证业务域，放在控制器层）
-	if user.Status == model.StatusBanned {
-		common.ClearAuthCookies(c, ac.cfg)
-		common.Error(c, http.StatusForbidden, "账号已被封禁")
-		return
-	}
-
 	common.SetAccessCookie(c, accessToken, ac.cfg)
 
 	common.Ok(c, nil)

internal/service/audit_service.go

@@ -225,20 +225,15 @@ func (s *AuditService) applyApproval(submission *model.AuditSubmission) error {
 
 // List 分页查询审核列表
 func (s *AuditService) List(auditType, status string, page, pageSize int) (*AuditListResult, error) {
-	if page < 1 {
-		page = 1
-	}
-	if pageSize < 1 || pageSize > 100 {
-		pageSize = 20
-	}
-	offset := (page - 1) * pageSize
+	p := common.Pagination{Page: page, PageSize: pageSize}
+	p.DefaultPagination()
 
 	total, err := s.auditRepo.CountAudits(auditType, status)
 	if err != nil {
 		return nil, err
 	}
 
-	items, err := s.auditRepo.ListAudits(auditType, status, offset, pageSize)
+	items, err := s.auditRepo.ListAudits(auditType, status, p.Offset(), p.PageSize)
 	if err != nil {
 		return nil, err
 	}
@@ -249,7 +244,7 @@ func (s *AuditService) List(auditType, status string, page, pageSize int) (*Audi
 	return &AuditListResult{
 		Items: items,
 		Total: total,
-		Page:  page,
+		Page:  p.Page,
 	}, nil
 }
 

internal/service/token_service.go

@@ -109,6 +109,11 @@ func (ts *TokenService) RefreshAccessToken(refreshTokenStr string) (string, *mod
 		return "", nil, common.ErrTokenRevoked
 	}
 
+	// 防止封禁用户通过 refresh 续期
+	if user.Status == model.StatusBanned {
+		return "", nil, common.ErrUserBanned
+	}
+
 	accessToken, err := ts.BuildAccessToken(user)
 	if err != nil {
 		return "", nil, err