fix: 设计原则审查修复 — DIP/ISP, LoD, DRY, OCP, URL, 301缓存

- P0 DIP+ISP: 全链路注入接口，消除零接口紧耦合
- P0 URL: auth 301→302，修复登出后浏览器缓存陷阱
- P1 DRY: JWT 认证逻辑收敛至 TokenService+中间件
- P2 DRY: 前后端角色/状态映射统一为 model 常量
- P2 LoD: 新增 SettingsController，router 不再跨层调 repo
- P2 URL: settings ?tab= → /settings/:tab 伪静态
- P3 OCP: 角色权限 map 化，告别硬编码 switch

templates/MetaLab-2026/html/home/index.html

@@ -3,17 +3,37 @@
 
 {{template "layout/nav.html" .}}
 
-<main class="hero">
-    <div class="container">
-        <h1>Meta<span>Lab</span></h1>
-        <p class="hero-tagline">下一代开发者社区</p>
-        {{if .IsLoggedIn}}
-        <p class="hero-desc">欢迎回来，{{.Username}}</p>
-        {{else}}
-        <p class="hero-desc">一个为构建者准备的纯粹空间</p>
-        {{end}}
-    </div>
-</main>
+<div class="home-layout">
+    <main class="hero">
+        <div class="container">
+            <h1>Meta<span>Lab</span></h1>
+            <p class="hero-tagline">下一代开发者社区</p>
+            {{if .IsLoggedIn}}
+            <p class="hero-desc">欢迎回来，{{.Username}}</p>
+            {{else}}
+            <p class="hero-desc">一个为构建者准备的纯粹空间</p>
+            {{end}}
+        </div>
+    </main>
+
+    <aside class="sidebar">
+        <div class="sidebar-card user-card">
+            {{if .IsLoggedIn}}
+            <div class="user-card-avatar">{{slice .Username 0 1}}</div>
+            <h3 class="user-card-name">{{.Username}}</h3>
+            <p class="user-card-desc">欢迎加入 MetaLab</p>
+            <a href="/settings/profile" class="user-card-link">个人设置</a>
+            {{else}}
+            <div class="user-card-avatar">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" width="28" height="28"><circle cx="12" cy="8" r="4"/><path d="M4 20c0-4 4-7 8-7s8 3 8 7"/></svg>
+            </div>
+            <h3 class="user-card-name">未登录</h3>
+            <p class="user-card-desc">登录后解锁社区功能</p>
+            <a href="/auth/login" class="user-card-btn">登录</a>
+            {{end}}
+        </div>
+    </aside>
+</div>
 
 {{template "layout/footer.html" .}}