fix: 设计原则审查修复 — DIP/ISP, LoD, DRY, OCP, URL, 301缓存

- P0 DIP+ISP: 全链路注入接口，消除零接口紧耦合
- P0 URL: auth 301→302，修复登出后浏览器缓存陷阱
- P1 DRY: JWT 认证逻辑收敛至 TokenService+中间件
- P2 DRY: 前后端角色/状态映射统一为 model 常量
- P2 LoD: 新增 SettingsController，router 不再跨层调 repo
- P2 URL: settings ?tab= → /settings/:tab 伪静态
- P3 OCP: 角色权限 map 化，告别硬编码 switch

templates/admin/html/layout/base.html

@@ -16,14 +16,14 @@
         <a href="/admin" class="admin-logo">MetaLab <span>管理面板</span></a>
         <div class="admin-header-right">
             <span class="admin-user">{{.Username}}</span>
-            <a href="/" class="admin-back-btn">← 返回前台</a>
+            <a href="/" class="admin-back-btn"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="14" height="14" style="vertical-align:-2px;margin-right:3px;"><path d="m3 9 9-7 9 7v11a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/><polyline points="9 22 9 12 15 12 15 22"/></svg>返回前台</a>
         </div>
     </div>
 </header>
 <div class="admin-container">
     <aside class="admin-sidebar">
         <nav>
-            <a href="/admin" class="sidebar-item {{if eq .CurrentPath "/admin"}}active{{end}}">
+            <a href="/admin" class="sidebar-item {{if eq .CurrentPath "/admin/"}}active{{end}}">
                 <span class="sidebar-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/></svg></span>
                 管理首页
             </a>

templates/admin/html/layout/footer.html

@@ -1,5 +1,6 @@
     </main>
 </div>
+<script src="/shared/static/js/utils.js"></script>
 <script src="/admin/static/js/common.js"></script>
 {{if .ExtraJS}}
 <script src="{{.ExtraJS}}"></script>