feat: 敏感操作增加IP维度限流

- RateLimiter 新增 AllowSensitive 方法（1分钟5次，超限封禁5分钟）
- 新增 SensitiveRateLimit Gin 中间件
- 改密（PUT /api/settings/password）增加限流保护
- 注销（POST /api/settings/delete-account）增加限流保护
- 签到（POST /api/level/checkin）增加限流保护

internal/router/api.go

@@ -17,8 +17,8 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	{
 		settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
 		settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
-		settingsAPI.PUT("/password", d.settingsCtrl.ChangePassword)
-		settingsAPI.POST("/delete-account", d.settingsCtrl.DeleteAccount)
+		settingsAPI.PUT("/password", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.ChangePassword)
+		settingsAPI.POST("/delete-account", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.DeleteAccount)
 		settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
 		// 登录管理
 		settingsAPI.GET("/sessions", d.settingsCtrl.ListSessions)
@@ -47,7 +47,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	levelAPI.Use(d.authMdw.BannedWriteGuard())
 	levelAPI.Use(middleware.CSRF(cfg))
 	{
-		levelAPI.POST("/checkin", d.levelCtrl.CheckIn)
+		levelAPI.POST("/checkin", middleware.SensitiveRateLimit(d.rateLimiter), d.levelCtrl.CheckIn)
 		levelAPI.GET("/info", d.levelCtrl.GetLevel)
 	}