feat: 敏感操作增加IP维度限流

- RateLimiter 新增 AllowSensitive 方法（1分钟5次，超限封禁5分钟）
- 新增 SensitiveRateLimit Gin 中间件
- 改密（PUT /api/settings/password）增加限流保护
- 注销（POST /api/settings/delete-account）增加限流保护
- 签到（POST /api/level/checkin）增加限流保护

internal/router/deps_extra.go

@@ -16,7 +16,7 @@ import (
 )
 
 func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings, redisClient *redis.Client) *dependencies {
-	userRepo, sessionMgr, authService, _, authCtrl, avatarSvc, authMdw := buildDepsCore(db, cfg, siteSettings, redisClient)
+	userRepo, sessionMgr, authService, rateLimiter, authCtrl, avatarSvc, authMdw := buildDepsCore(db, cfg, siteSettings, redisClient)
 
 	auditRepo := repository.NewAuditRepo(db)
 	notificationRepo := repository.NewNotificationRepo(db)
@@ -107,7 +107,7 @@ func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSetting
 	postService.WithHomePageInvalidator(func() { homeCache.Invalidate() })
 
 	return &dependencies{
-		authCtrl: authCtrl, authMdw: authMdw, maintenanceMdw: maintenanceMdw,
+		authCtrl: authCtrl, authMdw: authMdw, rateLimiter: rateLimiter, maintenanceMdw: maintenanceMdw,
 		settingsCtrl: settingsCtrl,
 		messageCtrl:  messageController, postCtrl: postCtrl, postService: postService, spaceCtrl: spaceCtrl,
 		studioCtrl:    studioCtrl,