fix: 审计问题全量修复 + RateLimiter 原子化重构 + CDN 本地化收紧

- 安全：移除 CSP 中 esm.sh/cdnjs.cloudflare.com，highlight.js 主题已本地化 73 个文件
- 安全：StatusBanned 分支补 dummy hash 防时序攻击
- 安全：手写 constantTimeEq 替换为 crypto/subtle.ConstantTimeCompare
- Bug：锁定操作消息已删除→已锁定
- YAGNI：删除 12 个空预留模板目录
- KISS：删除 common.CheckPassword 薄封装，统一用 bcrypt 调用
- KISS：删除 tokenCtrl 别名字段，api.go 统一用 authCtrl
- RateLimiter：check()+recordFail 闭包模式重构为 try() 原子操作，消除竞态
- RateLimiter：新增 ClearIP() 方法，注册成功时清除 IP 计数
- 文档：修正 audit_service.go 注释编号跳跃(3→5→4)
- 文档：修正 deps_core.go 过清理→过期清理

internal/service/audit_service.go

@@ -172,7 +172,7 @@ func (s *AuditService) review(reviewerID uint, submissionID uint, approved bool,
 		return common.ErrUserNotFound
 	}
 
-	// 5. 标记审核结果
+	// 4. 标记审核结果
 	submission.ReviewedBy = &reviewerID
 	submission.ReviewerName = &reviewer.Username
 	if approved {

internal/service/auth_service.go

@@ -135,7 +135,7 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (*model.User
 
 	// 已注销（deleted）→ 验证密码后要求二次确认
 	if user.Status == model.StatusDeleted {
-		if !common.CheckPassword(req.Password, user.PasswordHash) {
+		if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 			_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
 			return nil, common.ErrInvalidCred
 		}
@@ -150,10 +150,11 @@ func (s *AuthService) Login(req model.LoginRequest, loginIP string) (*model.User
 
 	// 封禁
 	if user.Status == model.StatusBanned {
+		_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
 		return nil, common.ErrUserBanned
 	}
 
-	if !common.CheckPassword(req.Password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 		return nil, common.ErrInvalidCred
 	}
 
@@ -180,7 +181,7 @@ func (s *AuthService) ConfirmRestore(req model.LoginRequest, loginIP string) (*m
 		return nil, common.ErrUserNotFound
 	}
 
-	if !common.CheckPassword(req.Password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)) != nil {
 		return nil, common.ErrInvalidCred
 	}
 
@@ -215,7 +216,7 @@ func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword s
 		return common.ErrUserNotFound
 	}
 
-	if !common.CheckPassword(currentPassword, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(currentPassword)) != nil {
 		return common.ErrIncorrectPassword
 	}
 
@@ -248,7 +249,7 @@ func (s *AuthService) DeleteAccount(userID uint, password, reason string) error
 		return common.ErrOwnerCannotDelete
 	}
 
-	if !common.CheckPassword(password, user.PasswordHash) {
+	if bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)) != nil {
 		return common.ErrIncorrectPassword
 	}
 

internal/service/shortcode_service.go

@@ -124,14 +124,18 @@ func renderPlaceholder(sc model.Shortcode) string {
 		)
 
 	case model.ShortcodePoll:
-		// [zone:poll:投票ID] ※预留
+		// [zone:poll:投票ID]
+		// 前端根据投票ID获取标题、选项、截止时间等信息
+		// ※后端 API 开发中
 		return fmt.Sprintf(
-			`<div class="zone-card" data-zone-type="poll" data-zone-id="%s"><span class="zone-card-loading">投票组件加载中...</span></div>`,
+			`<div class="zone-card" data-zone-type="poll" data-zone-id="%s"><span class="zone-card-loading">投票卡片加载中...</span></div>`,
 			html.EscapeString(sc.Params),
 		)
 
 	case model.ShortcodeResource:
-		// [zone:resource:资源ID] ※预留
+		// [zone:resource:资源ID]
+		// 前端根据资源ID获取名称、描述、下载链接等信息
+		// ※后端 API 开发中
 		return fmt.Sprintf(
 			`<div class="zone-card" data-zone-type="resource" data-zone-id="%s"><span class="zone-card-loading">资源卡片加载中...</span></div>`,
 			html.EscapeString(sc.Params),