fix: 修复帖子提交审核权限缺失 + 防重复提交 + 分页逻辑复用

- 修复 Submit API 缺少 uid 权限检查，任意登录用户可提交他人帖子审核
- 前端 handleSubmit 添加 submitting 锁和按钮禁用/恢复，防止重复提交
- 分页计算 TotalPages/PrevPage/NextPage 提取为 Pagination 方法，消除三处重复代码

templates/MetaLab-2026/static/js/editor.js

@@ -17,6 +17,7 @@ import { common, createLowlight } from 'lowlight'
 let editor = null
 let currentHTML = ''
 let draftTimer = null
+let submitting = false
 
 // ---- 初始化 ----
 document.addEventListener('DOMContentLoaded', () => {
@@ -337,25 +338,34 @@ function handleKeyboard(e) {
 async function handleSubmit(e) {
     e.preventDefault()
 
-    const postId = document.getElementById('postId')?.value
-    const title = document.getElementById('postTitle')?.value.trim()
+    if (submitting) return
+    submitting = true
 
-    if (!title) { alert('请输入标题'); return }
-
-    // 获取编辑器 HTML 内容
-    const body = editor ? editor.getHTML() : ''
-    // 忽略空段落
-    const cleanBody = body === '<p></p>' ? '' : body
-    if (!cleanBody.trim()) { alert('请输入正文'); return }
-
-    const isEdit = !!postId
-    const url = isEdit ? '/api/posts/' + postId : '/api/posts'
-    const method = isEdit ? 'PUT' : 'POST'
-
-    const csrfMeta = document.querySelector('meta[name="csrf-token"]')
-    const csrf = csrfMeta ? csrfMeta.getAttribute('content') : ''
+    const submitBtn = document.querySelector('.btn-submit')
+    if (submitBtn) {
+        submitBtn.disabled = true
+        submitBtn.textContent = '提交中...'
+    }
 
     try {
+        const postId = document.getElementById('postId')?.value
+        const title = document.getElementById('postTitle')?.value.trim()
+
+        if (!title) { alert('请输入标题'); return }
+
+        // 获取编辑器 HTML 内容
+        const body = editor ? editor.getHTML() : ''
+        // 忽略空段落
+        const cleanBody = body === '<p></p>' ? '' : body
+        if (!cleanBody.trim()) { alert('请输入正文'); return }
+
+        const isEdit = !!postId
+        const url = isEdit ? '/api/posts/' + postId : '/api/posts'
+        const method = isEdit ? 'PUT' : 'POST'
+
+        const csrfMeta = document.querySelector('meta[name="csrf-token"]')
+        const csrf = csrfMeta ? csrfMeta.getAttribute('content') : ''
+
         const resp = await fetch(url, {
             method,
             headers: {
@@ -380,5 +390,12 @@ async function handleSubmit(e) {
         } else {
             alert('请求失败，请重试')
         }
+    } finally {
+        submitting = false
+        if (submitBtn) {
+            submitBtn.disabled = false
+            submitBtn.textContent = submitBtn.textContent === '提交中...' ?
+                (document.getElementById('postId')?.value ? '保存修改' : '发布帖子') : submitBtn.textContent
+        }
     }
 }