fix: 设计原则审查修复 — DIP/ISP, LoD, DRY, OCP, URL, 301缓存

- P0 DIP+ISP: 全链路注入接口，消除零接口紧耦合
- P0 URL: auth 301→302，修复登出后浏览器缓存陷阱
- P1 DRY: JWT 认证逻辑收敛至 TokenService+中间件
- P2 DRY: 前后端角色/状态映射统一为 model 常量
- P2 LoD: 新增 SettingsController，router 不再跨层调 repo
- P2 URL: settings ?tab= → /settings/:tab 伪静态
- P3 OCP: 角色权限 map 化，告别硬编码 switch

internal/middleware/admin.go

@@ -4,63 +4,11 @@ import (
 	"log"
 	"net/http"
 
-	"metazone.cc/metalab/internal/common"
-	"metazone.cc/metalab/internal/config"
 	"metazone.cc/metalab/internal/model"
-	"metazone.cc/metalab/internal/repository"
 
 	"github.com/gin-gonic/gin"
 )
 
-// AdminAuth 管理后台页面认证中间件
-// 逻辑同 AuthRequired（JWT 校验 + token_version 吊销检查）
-// 但失败时重定向到首页，而非返回 JSON
-// 成功时向 context 注入 uid/email/username/role
-func AdminAuth(cfg *config.Config, userRepo *repository.UserRepo) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		tokenStr, err := c.Cookie(common.CookieName)
-		if err != nil {
-			log.Printf("[AdminAuth] NO_COOKIE path=%s → 302", c.Request.URL.Path)
-			c.Redirect(http.StatusFound, "/")
-			c.Abort()
-			return
-		}
-
-		claims, err := parseToken(tokenStr, cfg.JWT.Secret)
-		if err != nil {
-			log.Printf("[AdminAuth] TOKEN_PARSE_FAIL path=%s err=%v → 302", c.Request.URL.Path, err)
-			common.ClearAuthCookies(c, cfg)
-			c.Redirect(http.StatusFound, "/")
-			c.Abort()
-			return
-		}
-
-		uid := uint(claims["uid"].(float64))
-		tokenVer := int(claims["ver"].(float64))
-
-		// 即时吊销检查
-		currentVer, err := userRepo.FindTokenVersion(uid)
-		if err != nil || tokenVer != currentVer {
-			if tokenVer != currentVer {
-				log.Printf("[AdminAuth] REVOKED: uid=%d tokenVer=%d dbVer=%d → 302", uid, tokenVer, currentVer)
-			} else {
-				log.Printf("[AdminAuth] DB_ERR: uid=%d err=%v → 302", uid, err)
-			}
-			common.ClearAuthCookies(c, cfg)
-			c.Redirect(http.StatusFound, "/")
-			c.Abort()
-			return
-		}
-
-		log.Printf("[AdminAuth] OK: uid=%d role=%v path=%s", uid, claims["role"], c.Request.URL.Path)
-		c.Set("uid", uid)
-		c.Set("email", claims["email"])
-		c.Set("username", claims["username"])
-		c.Set("role", claims["role"])
-		c.Next()
-	}
-}
-
 // RequireMinRole 角色权限检查（用于 API 路由）
 // 不足时返回 JSON 403
 func RequireMinRole(minRole string) gin.HandlerFunc {