feat: 封禁用户允许登录但禁止写操作

- Session 结构体新增 Status 字段，Create/Validate 同步状态
- AuthService.Login 移除封禁检查，允许封禁用户登录
- 新增 BannedWriteGuard 中间件，拦截 POST/PUT/DELETE 写操作
- 封禁用户自动签到跳过
- 所有需登录的 API 路由组应用 BannedWriteGuard
- AdminService.UpdateUserStatus 保留 DestroyByUID 确保状态刷新

internal/router/admin.go

@@ -34,6 +34,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	adminAPI := r.Group("/api/admin")
 	adminAPI.Use(d.authMdw.Required())
 	adminAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminAPI.Use(d.authMdw.BannedWriteGuard())
 	adminAPI.Use(middleware.CSRF(cfg))
 	{
 		adminAPI.GET("/users", d.adminCtrl.ListUsers)
@@ -48,6 +49,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	siteSettingsAPI := r.Group("/api/admin/site-settings")
 	siteSettingsAPI.Use(d.authMdw.Required())
 	siteSettingsAPI.Use(middleware.RequireMinRole(model.RoleOwner))
+	siteSettingsAPI.Use(d.authMdw.BannedWriteGuard())
 	siteSettingsAPI.Use(middleware.CSRF(cfg))
 	{
 		siteSettingsAPI.GET("", d.siteSettingCtrl.GetSettings)
@@ -60,6 +62,7 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	adminPostAPI := r.Group("/api/admin/posts")
 	adminPostAPI.Use(d.authMdw.Required())
 	adminPostAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminPostAPI.Use(d.authMdw.BannedWriteGuard())
 	adminPostAPI.Use(middleware.CSRF(cfg))
 	{
 		adminPostAPI.POST("/:id/approve", d.adminPostCtrl.Approve)

internal/router/api.go

@@ -12,6 +12,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	// --- 设置页 API（需登录） ---
 	settingsAPI := r.Group("/api/settings")
 	settingsAPI.Use(d.authMdw.Required())
+	settingsAPI.Use(d.authMdw.BannedWriteGuard())
 	settingsAPI.Use(middleware.CSRF(cfg))
 	{
 		settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
@@ -29,6 +30,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	// --- 消息中心 API（需登录） ---
 	messagesAPI := r.Group("/api/messages")
 	messagesAPI.Use(d.authMdw.Required())
+	messagesAPI.Use(d.authMdw.BannedWriteGuard())
 	messagesAPI.Use(middleware.CSRF(cfg))
 	{
 		messagesAPI.GET("/unread", d.messageCtrl.UnreadCount)
@@ -39,6 +41,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	// --- 积分/等级 API（需登录） ---
 	levelAPI := r.Group("/api/level")
 	levelAPI.Use(d.authMdw.Required())
+	levelAPI.Use(d.authMdw.BannedWriteGuard())
 	levelAPI.Use(middleware.CSRF(cfg))
 	{
 		levelAPI.POST("/checkin", d.levelCtrl.CheckIn)
@@ -64,6 +67,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	// --- 帖子 API（需登录） ---
 	postsAPI := r.Group("/api/posts")
 	postsAPI.Use(d.authMdw.Required())
+	postsAPI.Use(d.authMdw.BannedWriteGuard())
 	postsAPI.Use(middleware.CSRF(cfg))
 	{
 		postsAPI.POST("/:id/submit", d.postCtrl.Submit)
@@ -73,6 +77,7 @@ func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
 	// --- 创作中心 API（需登录） ---
 	studioAPI := r.Group("/api/studio")
 	studioAPI.Use(d.authMdw.Required())
+	studioAPI.Use(d.authMdw.BannedWriteGuard())
 	studioAPI.Use(middleware.CSRF(cfg))
 	{
 		studioAPI.GET("/overview", d.studioCtrl.OverviewAPI)