fix: 设计原则审查修复 — DIP/ISP, LoD, DRY, OCP, URL, 301缓存

- P0 DIP+ISP: 全链路注入接口，消除零接口紧耦合
- P0 URL: auth 301→302，修复登出后浏览器缓存陷阱
- P1 DRY: JWT 认证逻辑收敛至 TokenService+中间件
- P2 DRY: 前后端角色/状态映射统一为 model 常量
- P2 LoD: 新增 SettingsController，router 不再跨层调 repo
- P2 URL: settings ?tab= → /settings/:tab 伪静态
- P3 OCP: 角色权限 map 化，告别硬编码 switch

templates/admin/html/users/index.html

@@ -9,17 +9,15 @@
             <input type="text" id="searchInput" class="filter-input" placeholder="搜索邮箱或用户名..." autocomplete="off">
             <select id="roleFilter" class="filter-select">
                 <option value="">全部角色</option>
-                <option value="user">普通用户</option>
-                <option value="moderator">版主</option>
-                <option value="admin">管理员</option>
-                <option value="owner">站长</option>
+                {{range $val, $label := .RoleNames}}
+                <option value="{{$val}}">{{$label}}</option>
+                {{end}}
             </select>
             <select id="statusFilter" class="filter-select">
                 <option value="">全部状态</option>
-                <option value="active">正常</option>
-                <option value="banned">已封禁</option>
-                <option value="deleted">已注销</option>
-                <option value="locked">已锁定</option>
+                {{range $val, $label := .StatusNames}}
+                <option value="{{$val}}">{{$label}}</option>
+                {{end}}
             </select>
             <button id="searchBtn" class="btn btn-primary">搜索</button>
         </div>
@@ -46,5 +44,17 @@
 
         <!-- 分页 -->
         <div class="pagination-bar" id="paginationBar"></div>
-<script>window.__currentUid = {{.UID}}; window.__isOwner = {{if .IsOwner}}true{{else}}false{{end}};</script>
+<script>
+window.__currentUid = {{.UID}};
+window.__isOwner = {{if .IsOwner}}true{{else}}false{{end}};
+// 由服务端 model.RoleDisplayNames / StatusDisplayNames 作为唯一数据源注入
+window.__ROLE_NAMES = {
+    {{range $val, $label := .RoleNames}}"{{$val}}": "{{$label}}",
+    {{end}}
+};
+window.__STATUS_NAMES = {
+    {{range $val, $label := .StatusNames}}"{{$val}}": "{{$label}}",
+    {{end}}
+};
+</script>
 {{template "admin/layout/footer.html" .}}